Merge pull request #13511 from tspascoal/patch-1

JS: Single quote was preventing the shell from expanding the BODY variable in Expression injection in Actions example
2026-04-25 00:35:20 +02:00 · 2023-06-21 09:57:20 +02:00
parent 5259a6ecfc 150854603b
commit 12b3913a4b
1 changed files with 1 additions and 1 deletions
--- a/javascript/ql/src/Security/CWE-094/examples/comment_issue_good.yml
+++ b/javascript/ql/src/Security/CWE-094/examples/comment_issue_good.yml
@@ -7,4 +7,4 @@ jobs:
    - env:
        BODY: ${{ github.event.issue.body }}
      run: |
-        echo '$BODY'
+        echo "$BODY"