fix: exclude information about the repo and owner (#136)

woodruffw · Nov 8, 2024 · 7f30170 · 7f30170
1 parent 666ff1a
commit 7f30170
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/audit/template_injection.rs b/src/audit/template_injection.rs
@@ -40,6 +40,13 @@ const SAFE_CONTEXTS: &[&str] = &[
     "github.event.number",
     "github.event.merge_group.base_sha",
     "github.event.workflow_run.id",
+    // Information about the GitHub repostory
+    "github.repository",
+    "github.repository_id",
+    "github.repostoryUrl",
+    // Information about the GitHub repository owner (account/org or ID)
+    "github.repository_owner",
+    "github.repository_owner_id",
     // Unique numbers assigned by GitHub for workflow runs
     "github.run_attempt",
     "github.run_id",