Program: CWE-79
Project: CVE-2022-0929
Buggy source:
name: Microweber build & upload

on:
  push:

jobs:
  microweber-test-before-build:
    runs-on: ubuntu-latest
    needs: stop-previous-runs
    steps:
      - uses: actions/checkout@v2

      - name: Install Dependencies
        run: composer install

      - name: Dump autoload dependecies
        run: composer dump-autoload

      - name: Run PHPUnit
        run: php artisan test --debug

  microweber-build-and-upload:
    runs-on: ubuntu-latest
    needs: microweber-test-before-build
    steps:
    - uses: actions/checkout@v2

    - name: Install Dependencies
      run: composer install

    - name: Dump autoload dependecies
      run: composer dump-autoload

    - name: Inject slug/short variables
      uses: rlespinasse/github-slug-action@v3.x

    - name: Zip the files
      run: |
        rm -rf .git
        rm -rf .github
        find . \( -name ".git" -o -name ".gitignore" -o -name ".gitmodules" -o -name ".gitattributes" \) -exec rm -rf -- {} +
        zip -r microweber-${{ env.GITHUB_REF_SLUG }}.zip `ls -A`
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.zip ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}

    - name: Upload composer.json
      run: |
        cp -r composer.json microweber-${{ env.GITHUB_REF_SLUG }}.composer.json
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.composer.json ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}
    - name: Upload version.txt
      run: |
        cp -r version.txt microweber-${{ env.GITHUB_REF_SLUG }}.version.txt
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.version.txt ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}


Fixed version (ground truth):
name: Microweber build & upload

on:
  push:

jobs:
  microweber-test-before-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Install Dependencies
        run: composer install

      - name: Dump autoload dependecies
        run: composer dump-autoload

      - name: Run PHPUnit
        run: php artisan test --debug

  microweber-build-and-upload:
    runs-on: ubuntu-latest
    needs: microweber-test-before-build
    steps:
    - uses: actions/checkout@v2

    - name: Install Dependencies
      run: composer install

    - name: Dump autoload dependecies
      run: composer dump-autoload

    - name: Inject slug/short variables
      uses: rlespinasse/github-slug-action@v3.x

    - name: Zip the files
      run: |
        rm -rf .git
        rm -rf .github
        find . \( -name ".git" -o -name ".gitignore" -o -name ".gitmodules" -o -name ".gitattributes" \) -exec rm -rf -- {} +
        zip -r microweber-${{ env.GITHUB_REF_SLUG }}.zip `ls -A`
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.zip ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}

    - name: Upload composer.json
      run: |
        cp -r composer.json microweber-${{ env.GITHUB_REF_SLUG }}.composer.json
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.composer.json ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}
    - name: Upload version.txt
      run: |
        cp -r version.txt microweber-${{ env.GITHUB_REF_SLUG }}.version.txt
        curl -T microweber-${{ env.GITHUB_REF_SLUG }}.version.txt ftp://${{ secrets.FTP_USERNAME }}:${{ secrets.FTP_PASSWORD }}@${{ secrets.FTP_HOST }}