Passing an empty Github Action variable to remote_path
circumvents validation and targets the root /
directory
#44
Labels
remote_path
circumvents validation and targets the root /
directory
#44
As the title says, I accidentally passed an empty variable to
remote_path
(I wrote${{ env.REMOTE_PATH }}
instead of${{ vars.REMOTE_PATH }}
). I was expecting this action to throw an error if I had mistyped, but the action actually ran and – you know the rest. I basically nuked the root directory of the remote server, since I also passed the--delete
flag.A more fool proof validation of the required input variables would be appreciated.
The text was updated successfully, but these errors were encountered: