actions/checkout
1
0
Fork 0
mirror of https://github.com/actions/checkout.git synced 2026-07-16 15:35:37 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

trim only ascii whitespace for branch (#2521)
Some checks failed
Build and Test / test (macos-latest) (push) Waiting to run
Details
Build and Test / test (windows-latest) (push) Waiting to run
Details
Build and Test / test-git-container (push) Failing after 13s
Details
Build and Test / test-proxy (push) Failing after 15s
Details
Build and Test / test-output (push) Successful in 20s
Details
Build and Test / test-bypass-proxy (push) Failing after 36s
Details
Licensed / Check licenses (push) Successful in 45s
Details
Check dist / check-dist (push) Successful in 1m25s
Details
Build and Test / test (ubuntu-latest) (push) Failing after 1m29s
Details
CodeQL / Analyze (javascript) (push) Failing after 30m34s
Details
Build and Test / build (push) Failing after 31m57s
Details

Browse Source 
* trim only ascii whitespace for branch

* rebuild
This commit is contained in:
Aiqiao Yan
2026-07-15 15:05:42 -04:00
committed by GitHub
parent 62661c4e71
commit 12cd2235ef
3 changed files with 80 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
dist/index.js vendored
View File

@@ -42100,6 +42100,22 @@ async function getInputs() {
`${github_context.repo.owner}/${github_context.repo.repo}`.toUpperCase();
// Source branch, source version
result.ref = getInput('ref');
// core.getInput()'s default trim strips a range of Unicode characters such as a
// leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
// a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
// be silently reclassified as a commit, bypassing the unsafe fork PR checkout
// guard.
//
// The trim below strips only the ASCII whitespace characters which are all forbidden
// in a git branch name.
// \t U+0009 horizontal tab - ASCII control, forbidden in ref names
// \n U+000A line feed - ASCII control, forbidden in ref names
// \v U+000B vertical tab - ASCII control, forbidden in ref names
// \f U+000C form feed - ASCII control, forbidden in ref names
// \r U+000D carriage return - ASCII control, forbidden in ref names
// ' ' U+0020 space - forbidden in ref names
const asciiTrimmedRef = getInput('ref', { trimWhitespace: false })
.replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '');
if (!result.ref) {
if (isWorkflowRepository) {
result.ref = github_context.ref;
@@ -42112,8 +42128,8 @@ async function getInputs() {
}
}
// SHA?
else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
result.commit = result.ref;
else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
result.commit = asciiTrimmedRef;
result.ref = '';
}
core_debug(`ref = '${result.ref}'`);