Hacker News Reader

Comment by SahAssar | Hacker News Reader

Github should not disallow/filter branch names. Developers should write (and be be given the tools to) workflows that do not allow command injection.

View on HN

GitHub could disallow/filter branch names. Developers will not write (and be be given the tools to) workflows that do not allow command injection.

Do you have the same reasoning for SQL/XXS injection? Should developers not write code that is resistant to SQL/XXS injection and instead rely on something like a WAF?

These protections (WAF for SQL/XSS, branch names for this) will never be enough. The code/logic must be secure, any additional layer is not enough since the actual target must be secured.

Developers will do it if its necessary, and it is. These situations are just proving it is necessary.

the garbage that is yaml "builds" is essentially impossible to secure

untyped strings, untyped strings everywhere

and they're directly executed, with untrusted user input templated in, with full release privileges

the entire thing is insane

to think pypa deprecated pgp offline signing for this...

Why not both? Git itself checks and sanitizes branch names, and GitHub should arguably match that behavior. I don't think anyone would object to safer workflows and related tooling instead of being told "here, have some bash inside YAML, now be careful!"

Of course I agree that github should follow the git spec for branch names. I meant that I don't think github should impose any additional restrictions on branch names.

Reply on news.ycombinator.com