envpath-injection-medium.yaml

name: PATH Injection Medium - Normal Triggers
on:
  # Normal triggers with limited permissions
  pull_request:
    types: [opened, synchronize]
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * *'

jobs:
  # MEDIUM: Untrusted input written to GITHUB_PATH with normal trigger
  unsafe-pr:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH from PR body
        run: |
          echo "${{ github.event.pull_request.body }}" >> "$GITHUB_PATH"

      - name: Use the PATH
        run: 'echo "PATH updated"'

  # MEDIUM: Untrusted input from PR title
  unsafe-pr-title:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH from PR title
        run: |
          echo "${{ github.event.pull_request.title }}" >> $GITHUB_PATH

  # MEDIUM: Untrusted input from head ref
  unsafe-head-ref:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH from head ref
        run: |
          echo "${{ github.event.pull_request.head.ref }}" >> "$GITHUB_PATH"

  # MEDIUM: Multiple untrusted inputs
  unsafe-multiple:
    runs-on: ubuntu-latest
    steps:
      - name: Set multiple paths
        run: |
          echo "${{ github.event.pull_request.title }}" >> $GITHUB_PATH
          echo "${{ github.event.pull_request.user.login }}" >> $GITHUB_PATH

  # SAFE: Using realpath to validate the path
  safe-with-realpath:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH safely with realpath
        env:
          USER_PATH: ${{ github.event.pull_request.body }}
        run: |
          VALIDATED_PATH=$(realpath "$USER_PATH")
          echo "$VALIDATED_PATH" >> "$GITHUB_PATH"

  # SAFE: Using environment variable as intermediary with validation
  safe-with-env-validation:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH with validation
        env:
          USER_PATH: ${{ github.event.pull_request.body }}
        run: |
          # Validate the path exists and is a directory
          if [ -d "$USER_PATH" ]; then
            echo "$USER_PATH" >> "$GITHUB_PATH"
          fi

  # SAFE: Not using untrusted input
  safe-trusted-only:
    runs-on: ubuntu-latest
    steps:
      - name: Set PATH from trusted sources
        run: |
          echo "${{ github.sha }}" >> "$GITHUB_PATH"
          echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"

  # SAFE: Using hardcoded paths
  safe-hardcoded:
    runs-on: ubuntu-latest
    steps:
      - name: Set known PATH
        run: |
          echo "/opt/tools/bin" >> "$GITHUB_PATH"