Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions .github/workflows/self_hosted_integration_issues.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
name: Comment on self-hosted integration issues

on:
issues:
types: [opened]

jobs:
comment:
runs-on: ubuntu-latest
permissions:
issues: write
steps:
- name: Check if issue contains keywords
id: check
run: |
body="${{ github.event.issue.body }}"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: GitHub Actions Vulnerable to Command Injection

The GitHub issue body is directly interpolated into a bash variable without proper escaping. This allows shell metacharacters to execute arbitrary commands on the GitHub Actions runner.

Fix in Cursor Fix in Web

shopt -s nocasematch
if [[ "$body" == *"self-hosted (https://develop.sentry.dev/self-hosted/)"* && "$body" == *"integration"* && "$body" == *"sentry.io"* ]]; then
echo "match=true" >> $GITHUB_OUTPUT
else
echo "match=false" >> $GITHUB_OUTPUT
fi
- name: Comment on issue
if: steps.check.outputs.match == 'true'
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: "Hi! 👋 It looks like you're asking about an integration with self-hosted Sentry. Integrations work differently on self-hosted Sentry so we created separate docs here: https://develop.sentry.dev/integrations/. Please take a look and let us know if you need further help."
})
- name: Add 'Waiting for: Community' label
if: steps.check.outputs.match == 'true'
uses: actions/github-script@v7
with:
script: |
github.rest.issues.addLabels({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
labels: ["Waiting for: Community"]
})
Loading