actions/http-client
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict sanitization to only allow 0-9, a-z, _, -, .

Browse Source 
Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]andTingluoHuang committed 2026-01-06 17:37:28 +00:00
1 parent 4777b1b6f6
commit b6fa82dca7
1 file changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files
src/index.ts
+3 -3
View File
@@ -821,9 +821,9 @@ export class HttpClient {
private _getUserAgentWithOrchestrationId(userAgent: string): string { private _getUserAgentWithOrchestrationId(userAgent: string): string {
const orchId = process.env['ACTIONS_ORCHESTRATION_ID'] const orchId = process.env['ACTIONS_ORCHESTRATION_ID']
if (orchId) { if (orchId) {
// Sanitize the orchestration ID to ensure it contains only valid token characters // Sanitize the orchestration ID to ensure it contains only valid characters
// Valid characters: alphanumeric, !, #, $, %, &, ', *, +, -, ., ^, _, `, |, ~ // Valid characters: 0-9, a-z, _, -, .
const sanitizedId = orchId.replace(/[^a-zA-Z0-9!#$%&'*+.^_`|~-]/g, '_') const sanitizedId = orchId.replace(/[^a-z0-9_.\-]/gi, '_')
return `${userAgent} actions_orchestration_id/${sanitizedId}` return `${userAgent} actions_orchestration_id/${sanitizedId}`
} }
return userAgent return userAgent