CVE-2023-26493 (Unknown, published 2023-03-27T22:15Z)
Description: value: Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/cocos/cocos-engine
Files changed:
Commit message: remove interface check workflow (#14281)



Vulnerable code:
const ps = require('path');
const fs = require('fs');

const interfaceDiffPath = ps.join(__dirname, '../../interface-diff.txt');
let reportContent = fs.readFileSync(interfaceDiffPath, 'utf8');

if (reportContent.includes('@')) {
    reportContent = reportContent.split('\n').slice(3).join('\n');
    reportContent = `## Interface Check Report
\`\`\`diff
! WARNING this pull request has changed these public interfaces:

${reportContent}
\`\`\`
`;
} else {
    reportContent = `## Interface Check Report
This pull request does not change any public interfaces !`;
}
fs.writeFileSync(interfaceDiffPath, reportContent, 'utf8');
name: <Web> Interface check

#on: push
on: [pull_request_target]

# github.head_ref is only defined on pull_request events
concurrency:
  group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  interface_check:
    permissions: read-all|write-all
    if: 
      (! contains(github.event.pull_request.body, '[X] does not change any runtime related code or build configuration'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v2
        with:
          node-version: '14.19'

      - name: clone REPO
        run: |
          git config --global user.name "test"
          git config --global user.email "test@test.com"
          git clone https://github.com/cocos-creator/engine.git
      
      - name: checkout BASE branch
        working-directory: ./engine
        run: |
          git fetch origin ${{ github.base_ref }}
          git checkout -b ${{ github.base_ref }}_BASE remotes/origin/${{ github.base_ref }}
          git branch

      - name: npm install BASE branch
        working-directory: ./engine
        run: |
          npm install --ignore-scripts

      - name: build BASE declaration
        working-directory: ./engine
        run: |
          npm run build-declaration
          cp ./bin/.declarations/cc.d.ts ../cc_base.d.ts

      - name: clear dependencies
        working-directory: ./engine
        run: |
          git checkout .
          git clean -xfd
          npm cache clean --force
          ls -la

      - name: merge HEAD branch
        working-directory: ./engine
        run: |
          git remote add HEAD_REPO https://github.com/${{ github.event.pull_request.head.repo.full_name }}.git
          git fetch HEAD_REPO ${{ github.head_ref }}
          git merge remotes/HEAD_REPO/${{ github.head_ref }}

      - name: npm install HEAD branch
        working-directory: ./engine
        run: |
          npm install --ignore-scripts

      - name: build HEAD declaration
        working-directory: ./engine
        run: |
          npm run build-declaration

      - uses: LouisBrunner/diff-action@v0.1.2
        with:
          old: ./cc_base.d.ts
          new: ./engine/bin/.declarations/cc.d.ts
          mode: addition
          tolerance: worse
          output: ./engine/interface-diff.txt

      - name: optimize interface check report
        working-directory: ./engine
        run: |
          cat ./interface-diff.txt
          node ./.github/workflows/interface-check-report.js

      - uses: marocchino/sticky-pull-request-comment@v2
        with:
          path: ./engine/interface-diff.txt

Fixed code: