Replace envsubst with JavaScript-based substitution to prevent template injection by Copilot · Pull Request #5773 · github/gh-aw

Copilot · 2025-12-07T14:00:20Z

Merged main branch

✅ Successfully merged main into PR branch (commit ad120b4)

Resolved merge conflicts in:
- spec-kit-executor.lock.yml - took our version, will recompile
- pkg/workflow/js.go - integrated new expirationHelpersScript from main

✅ Recompiled all workflows

Successfully compiled 102 workflow files
0 errors, 29 warnings (actions/github-script version warnings)
All workflows now include latest changes from main

Summary

Main branch merged successfully
All conflicts resolved
Build passing
All workflows recompiled with latest code
JavaScript-based substitution maintained (security fix intact)

Original prompt

This section details on the original issue you should resolve
<issue_title>[plan] Fix high-severity template injection in cloclo.md</issue_title>
<issue_description>## Objective
Fix the HIGH severity template injection vulnerability in .github/workflows/cloclo.md by replacing envsubst with safe in-place string substitution.
Context
The cloclo.md workflow uses envsubst on potentially untrusted data from ${{ needs.activation.outputs.text }}, creating a code injection vulnerability. This is marked as HIGH severity in the static analysis.
Current Vulnerable Pattern
env:
GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT: ${{ needs.activation.outputs.text }}run: | cat << 'PROMPT_EOF' | envsubst > "$GH_AW_PROMPT" [template content with $GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT] PROMPT_EOF
Required Changes
Replace the envsubst pattern with sed-based substitution:
env:
GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT: ${{ needs.activation.outputs.text }}run: | # Write template with placeholder directly to target file cat << 'PROMPT_EOF' > "$GH_AW_PROMPT" [template content with __GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT__] PROMPT_EOF # Safely substitute using sed (escapes pipe character to avoid delimiter conflicts) sed -i "s|__GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT__|${GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT//|/\\|}|g" "$GH_AW_PROMPT"
Replace all $VAR references in the template with __VAR__ placeholders
Recompile the workflow:make recompile
Files to Modify
.github/workflows/cloclo.md
Testing
Test the fix with malicious-looking input:
# Test content with shell metacharacters: $, `, \, $(), etc.echo"Test: \$(malicious_command) and \`backdoor\` and \${VAR}"
Verify:
Content is treated as literal text (not expanded)
Workflow completes successfully
Output contains the literal special characters
No shell expansion occurs
Acceptance Criteria
envsubst removed from cloclo.md
Safe sed-based substitution implemented
Template uses __VAR__ placeholder format
No .template files created
Workflow recompiled successfully
Passes zizmor static analysis scan
Manual test confirms no injection possible
Related to [plan] Fix template injection vulnerabilities using in-place string substitution #5752
AI generated by Plan Command for discussion #5735
Comments on the Issue (you are @copilot in this section)

Fixes[plan] Fix high-severity template injection in cloclo.md #5753

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Fixed JavaScript export/invocation bug in placeholder substitution. Updated pkg/workflow/js/substitute_placeholders.cjs and pkg/workflow/compiler_yaml.go, recompiled workflows and validated generated JS syntax.

🏴‍☠️ Ahoy! This treasure was crafted by Changeset Generator

Smoke Test Summary - Run 20009235856

Timestamp: 2025-12-07T19:32:52Z
Status: FAIL
Summary: 5/6 tests passed - gh safe-input tool requires GH_TOKEN authentication

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall

Changeset

Type: patch
Description: Replaced unsafe envsubst with JavaScript-based placeholder substitution; fixed JS export/invocation bug; recompiled workflows.

🏴‍☠️ Ahoy! This treasure was crafted by Changeset Generator

Smoke Test Summary - 2025-12-07T20:15:49Z

Status: PASS
Run ID: 20009718248
Summary: 5/6 tests passed - GitHub MCP, file I/O, Playwright, and cache memory verified successfully.

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

pelikhan

@copilot use JavaScript step to apply expansion, not repeated sed calls

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T15:04:18Z

@copilot use JavaScript step to apply expansion, not repeated sed calls

Replaced multiple sed calls with a single JavaScript step using actions/github-script. Created substitute_placeholders.cjs that performs all substitutions in one call, preventing shell expansion. Commit: 09f7250

pelikhan · 2025-12-07T18:50:26Z

@copilot merge main, recompile, format, lint

…injection-vulnerability # Conflicts: # .github/workflows/smoke-copilot-playwright.lock.yml

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T18:59:45Z

@copilot merge main, recompile, format, lint

Completed all tasks:

✅ Merged main branch (resolved conflict in smoke-copilot-playwright.lock.yml)
✅ Recompiled 101 workflows successfully
✅ Formatted code (JavaScript files updated)
✅ Linted (JavaScript passes; Go has 2 pre-existing unused function warnings)

Commit: 1afa626

github-actions · 2025-12-07T19:01:44Z

📰⚠️🔥❌🚨🔧 https://github.com/githubnext/gh-aw/actions/runs/20008876385

github-actions · 2025-12-07T19:01:44Z

💫 TO BE CONTINUED...Smoke Claude failed! Our hero faces unexpected challenges...

…injection-vulnerability # Conflicts: # .github/workflows/spec-kit-executor.lock.yml # pkg/workflow/js.go

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T19:48:15Z

@copilot merge main

Merged main branch successfully. Resolved conflicts in spec-kit-executor.lock.yml and js.go. Recompiled all 102 workflows with 0 errors. Commit: 2dfc324

github-actions · 2025-12-07T20:14:22Z

💥 WHOOSH!Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2025-12-07T20:14:23Z

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

github-actions · 2025-12-07T20:14:23Z

📰🚀🔍👀📡🕵️ https://github.com/githubnext/gh-aw/actions/runs/20009718295

github-actions · 2025-12-07T20:14:23Z

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-07T20:14:23Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-07T20:14:24Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-07T20:14:25Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-07T20:16:39Z

Smoke Test: Copilot Engine Validation - Run 20009718258

Last 2 Merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:

✅ GitHub MCP Testing
✅ File Writing Testing
✅ Bash Tool Testing
❌ GitHub MCP Default Toolset (get_me correctly unavailable with default toolsets)
✅ Cache Memory Testing
❌ Safe Input gh Tool (requires GH_TOKEN authentication)

Status: PASS (5/6 - expected failures confirmed correct behavior)

📰 BREAKING: Report filed by Smoke Copilot fer issue #5773 🗺️

github-actions · 2025-12-07T20:16:47Z

Smoke Test Results - Run 20009718274

Last 2 Merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:
✅ GitHub MCP - Retrieved PR data successfully
✅ File Writing - Created test file in /tmp/gh-aw/agent/
✅ Bash Tool - Verified file creation
✅ Playwright MCP - Navigated to GitHub.com, title verified
✅ Cache Memory - Created and verified cache file
✅ Safe Input gh Tool - Confirmed not authenticated (expected)

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:03Z

Smoke Test Results - Run 20009718248

Last 2 merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:

✅ GitHub MCP Testing (retrieved PRs)
✅ File Writing Testing (agent dir)
✅ Bash Tool Testing (file verified)
✅ Playwright MCP Testing (GitHub homepage: "GitHub · Change is constant...")
✅ Cache Memory Testing (cache dir verified)
⚠️ Safe Input gh Tool (not authenticated in this context)

Overall Status: PASS (5/6 tests successful)

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:26Z

Copilot Engine Smoke Test Results

Last 2 Merged PRs:

Unable to retrieve (GitHub MCP test failed)

Test Results:

✅ File Writing: Created and verified test file
✅ Bash Tool: Successfully executed commands
❌ GitHub MCP: Failed to retrieve PRs
❌ Serena MCP: Not accessible
❌ Safe Input gh Tool: Not tested due to previous failures

Overall Status: FAIL

📰🔥📋 https://github.com/githubnext/gh-aw/actions/runs/20009718295 fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:29Z

Smoke Test Results (Run 20009718520)

✅ Playwright MCP: Page title contains "GitHub"
✅ Cache Memory: File created and verified
❌ gh Safe-Input Tool: GH_TOKEN not configured

Overall Status: PARTIAL PASS

Note: gh tool requires GH_TOKEN environment variable to be set in the workflow.

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #5773 🗺️

github-actions · 2025-12-07T20:18:09Z

GitHub MCP merged PRs: #5781 "Fix linting errors and bundling failures in JavaScript workflow scripts"; #5780 "Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation"
GitHub MCP test: ✅
File write/read: ✅
Playwright title: ✅
Cache memory: ✅
gh issues list: ❌ (gh CLI unauthenticated)
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #5773 🗺️

Initial plan
64ae527

CopilotAI assigned Copilot and mnkiefer Dec 7, 2025

Copilotstarted work on behalf of mnkiefer December 7, 2025 14:00 View session

CopilotAIand others added 3 commits December 7, 2025 14:03

Initial assessment: Template injection vulnerability in cloclo.md
b6140e3
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Replace envsubst with safe sed-based substitution
b24ff15
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Update tests to match sed-based substitution pattern
75dd491
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

pelikhan reviewed Dec 7, 2025
View reviewed changes

Fix code review comments: update docs and template wrapping
5761b9d
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Fix high-severity template injection in cloclo.md~~Replace envsubst with sed-based substitution to prevent template injectionDec 7, 2025

CopilotAI requested a review from mnkiefer December 7, 2025 14:46

Copilotfinished work on behalf of mnkiefer December 7, 2025 14:46

Copilotstarted work on behalf of pelikhan December 7, 2025 14:46 View session

Replace multiple sed calls with single JavaScript substitution step
09f7250
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI changed the title ~~Replace envsubst with sed-based substitution to prevent template injection~~Replace envsubst with JavaScript-based substitution to prevent template injectionDec 7, 2025

Copilotfinished work on behalf of pelikhan December 7, 2025 15:06

CopilotAI requested a review from pelikhan December 7, 2025 15:06

pelikhan added the smoke label Dec 7, 2025

Copilotstarted work on behalf of pelikhan December 7, 2025 18:50 View session

GitHub Copilotand others added 2 commits December 7, 2025 18:54

Merge remote-tracking branch 'origin/main' into copilot/fix-template-…
8c0d68d
…injection-vulnerability # Conflicts: # .github/workflows/smoke-copilot-playwright.lock.yml

Merge main, recompile workflows, and format code
1afa626
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan added smoke and removed smoke labels Dec 7, 2025

Copilotfinished work on behalf of pelikhan December 7, 2025 19:01

pelikhan marked this pull request as ready for review December 7, 2025 19:01

GitHub Copilotand others added 2 commits December 7, 2025 19:46

Merge remote-tracking branch 'origin/main' into copilot/fix-template-…
ad120b4
…injection-vulnerability # Conflicts: # .github/workflows/spec-kit-executor.lock.yml # pkg/workflow/js.go

Merge main and recompile workflows
2dfc324
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan December 7, 2025 19:49

pelikhan added smoke and removed smoke smoke-claude smoke-copilot labels Dec 7, 2025

github-actionsBot added the smoke-copilot label Dec 7, 2025

github-actionsBot added smoke-claude smoke-copilot-no-firewall labels Dec 7, 2025

Add changeset [skip-ci]
ba93d48

pelikhan merged commit 09acc52 into mainDec 7, 2025
5 checks passed

pelikhan deleted the copilot/fix-template-injection-vulnerability branch December 7, 2025 20:17

github-actionsBot mentioned this pull request Dec 7, 2025
Fix safe-inputs MCP server to use HTTP transport for Codex engine #5782
Merged

CopilotAI mentioned this pull request Dec 16, 2025
[WIP] Fix template injection in single-instance workflows #6617
Closed
11 tasks

coderabbitaiBot mentioned this pull request Aug 1, 2026
chore: deploy Set it Free Loop (review tier, v2.0.0) HemSoft/codexbar-ios#222
Closed
4 tasks

Uh oh!

Conversation

CopilotAI commented Dec 7, 2025• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merged main branch

Summary

Context

Current Vulnerable Pattern

Required Changes

Files to Modify

Testing

Acceptance Criteria

Comments on the Issue (you are @copilot in this section)

Changeset

Smoke Test Summary - Run 20009235856

Changeset

Smoke Test Summary - 2025-12-07T20:15:49Z

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

CopilotAI commented Dec 7, 2025

Uh oh!

pelikhan commented Dec 7, 2025

Uh oh!

CopilotAI commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Dec 7, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

github-actionsBot commented Dec 7, 2025• edited by agentic-workflows-dev BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Dec 7, 2025

Smoke Test: Copilot Engine Validation - Run 20009718258

Uh oh!

github-actionsBot commented Dec 7, 2025

Smoke Test Results - Run 20009718274

Uh oh!

github-actionsBot commented Dec 7, 2025

Smoke Test Results - Run 20009718248

Uh oh!

github-actionsBot commented Dec 7, 2025

Copilot Engine Smoke Test Results

Uh oh!

github-actionsBot commented Dec 7, 2025

Smoke Test Results (Run 20009718520)

Uh oh!

Uh oh!

github-actionsBot commented Dec 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Dec 7, 2025•
edited by github-actions Bot
Loading

github-actionsBot commented Dec 7, 2025•
edited
Loading

github-actionsBot commented Dec 7, 2025•
edited
Loading

github-actionsBot commented Dec 7, 2025•
edited by agentic-workflows-dev Bot
Loading