CVE-2024-1540 (published 2024-03-27T16:15Z)

A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized modification of the base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within a `run` operation, where expressions inside `${{ }}` are evaluated and substituted before script execution. Remediation involves setting untrusted input values to intermediate environment variables to prevent direct influence on script generation.


Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/gradio-app/gradio
commit_details: repo_url: https://github.com/gradio-app/gradio
author: pngwn
author_date: 2024-02-09 18:01:44+00:00
msg: fix spaces comment and remove echos (#7373)

* remove unnecessary condition for deployment workflow

* remove unnecessary echo statements in GitHub Actions workflows

* fix website ci

* add condition to only run comment-spaces-start workflow if changes workflow outputs 'should_run' as 'true'
repository: repo_url: https://github.com/gradio-app/gradio
repo_name: gradio-app/gradio
description: Build and share delightful machine learning apps, all in Python. 🌟 Star to support our work!
repo_language: Python
owner: gradio-app
file_changes: filename: deploy+test-visual.yml
change_type: ModificationType.MODIFY
diff: @@ -34,11 +34,6 @@ jobs:
           type: "visual"
           token: ${{ secrets.GITHUB_TOKEN }}
           name: "UI Tests"
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-  
-
   comment-chromatic-start:
     uses: "./.github/workflows/comment-queue.yml"
     needs: changes

programming_language: Markdown
filename: deploy-spaces.yml
change_type: ModificationType.MODIFY
diff: @@ -25,6 +25,7 @@ jobs:
       source_repo: ${{ steps.changes.outputs.source_repo }}
       merge_sha: ${{ steps.changes.outputs.merge_sha }}
       mergeable: ${{ steps.changes.outputs.mergeable }}
+      found_pr: ${{ steps.changes.outputs.found_pr }}
     steps:
       - uses: actions/checkout@v4
       - uses: "gradio-app/gradio/.github/actions/changes@main"
@@ -34,13 +35,11 @@ jobs:
           name: "deploy / spaces"
           token: ${{ secrets.GITHUB_TOKEN }}
           commit_status: false
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
   
   comment-spaces-start:
     needs: changes
     uses: "./.github/workflows/comment-queue.yml"
+    if: ${{ needs.changes.outputs.should_run == 'true' }}
     secrets:
       gh_token: ${{ secrets.COMMENT_TOKEN }}
     with:
@@ -127,10 +126,7 @@ jobs:
   comment-spaces-success:
     uses: "./.github/workflows/comment-queue.yml"
     needs: [deploy-spaces, changes]
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      needs.deploy-spaces.result == 'success'
+    if: needs.deploy-spaces.result == 'success' && needs.changes.outputs.found_pr == 'true'
     secrets:
       gh_token: ${{ secrets.COMMENT_TOKEN }}
     with:
@@ -149,7 +145,7 @@ jobs:
   comment-spaces-failure:
     uses: "./.github/workflows/comment-queue.yml"
     needs: [deploy-spaces, changes]
-    if: always() && needs.deploy-spaces == 'failure'
+    if: always() && needs.deploy-spaces == 'failure' && needs.changes.outputs.found_pr == 'true'
     secrets:
       gh_token: ${{ secrets.COMMENT_TOKEN }}
     with:

programming_language: Shell
filename: deploy-website.yml
change_type: ModificationType.MODIFY
diff: @@ -39,10 +39,6 @@ jobs:
           type: "website"
           token: ${{ secrets.GITHUB_TOKEN }}
           commit_status: false
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-
   comment-deploy-start:
     needs: changes
     uses: "./.github/workflows/comment-queue.yml"
@@ -78,12 +74,6 @@ jobs:
           aws s3 cp ./js/_website/src/lib/json/ s3://gradio-docs-json/$version/ --recursive
       - name: Install Vercel CLI
         run: pnpm install --global vercel@latest
-      - name: echo outputs
-        run: |
-          echo "source_repo=${{ needs.changes.outputs.source_repo }}"
-          echo "source_branch=${{ needs.changes.outputs.source_branch }}"
-          echo "found_pr=${{ needs.changes.outputs.found_pr }}"
-          echo "pr_number=${{ needs.changes.outputs.pr_number }}"
       # preview
       - name: Pull Vercel Environment Information
         shell: bash

programming_language: Shell
filename: generate-changeset.yml
change_type: ModificationType.MODIFY
diff: @@ -28,10 +28,6 @@ jobs:
       uses: gradio-app/github/actions/find-pr@main
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: echo github context
-      if: always()
-      run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-
   comment-changes-start:
     uses: "./.github/workflows/comment-queue.yml"
     needs: get-pr

programming_language: CoffeeScript
filename: test-hygiene.yml
change_type: ModificationType.MODIFY
diff: @@ -32,10 +32,6 @@ jobs:
         with:
           type: "all"
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-  
   test-hygiene:
     name: "test-hygiene"
     runs-on: ubuntu-latest

programming_language: Markdown
filename: test-python.yml
change_type: ModificationType.MODIFY
diff: @@ -39,11 +39,6 @@ jobs:
           type: "gradio"
           name: "test / python / linux"
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-
-  
   test-python:
     needs: [changes]
     if: needs.changes.outputs.should_run == 'true'

programming_language: Shell
filename: tests-js.yml
change_type: ModificationType.MODIFY
diff: @@ -39,10 +39,6 @@ jobs:
         with:
           type: "js"
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
-
   test-js:
     needs: changes
     if: needs.changes.outputs.should_run == 'true'

programming_language: Markdown