Update benchmark.yml

withastro · Jul 11, 2023 · 8124fb5 · 8124fb5
1 parent feabf6c
commit 8124fb5
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
@@ -43,8 +43,11 @@ jobs:
 
       - name: Get bench command
         id: bench-command
+        env:
+          # protects from untrusted user input and command injection
+          COMMENT: ${{ github.event.comment.body }}
         run: |
-          benchcmd=$(echo "${{ github.event.comment.body }}" | grep '!bench' | awk -F ' ' '{print $2}')
+          benchcmd=$(echo "$COMMENT" | grep '!bench' | awk -F ' ' '{print $2}')
           echo "bench=$benchcmd" >> $GITHUB_OUTPUT
         shell: bash