Merge pull request #812 from github/sanitize-artifact-name

Sanitize artifact name before using
github · Nov 8, 2021 · ea8a175 · ea8a175
2 parents ea16943 + f360da7
commit ea8a175
Show file tree

Hide file tree

Showing 9 changed files with 30 additions and 6 deletions.
diff --git a/lib/actions-util.js b/lib/actions-util.js
diff --git a/lib/actions-util.js.map b/lib/actions-util.js.map
diff --git a/lib/actions-util.test.js b/lib/actions-util.test.js
diff --git a/lib/actions-util.test.js.map b/lib/actions-util.test.js.map
diff --git a/lib/analyze-action.js b/lib/analyze-action.js
diff --git a/lib/analyze-action.js.map b/lib/analyze-action.js.map
diff --git a/src/actions-util.test.ts b/src/actions-util.test.ts
@@ -680,3 +680,13 @@ test("isAnalyzingDefaultBranch()", async (t) => {
     t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), false);
   });
 });
+
+test("sanitizeArifactName", (t) => {
+  t.deepEqual(actionsutil.sanitizeArifactName("hello-world_"), "hello-world_");
+  t.deepEqual(actionsutil.sanitizeArifactName("hello`world`"), "helloworld");
+  t.deepEqual(actionsutil.sanitizeArifactName("hello===123"), "hello123");
+  t.deepEqual(
+    actionsutil.sanitizeArifactName("*m)a&n^y%i££n+v!a:l[i]d"),
+    "manyinvalid"
+  );
+});
diff --git a/src/actions-util.ts b/src/actions-util.ts
@@ -709,3 +709,7 @@ export async function isAnalyzingDefaultBranch(): Promise<boolean> {
 
   return currentRef === defaultBranch;
 }
+
+export function sanitizeArifactName(name: string): string {
+  return name.replace(/[^a-zA-Z0-9_\\-]+/g, "");
+}
diff --git a/src/analyze-action.ts b/src/analyze-action.ts
@@ -244,7 +244,7 @@ async function uploadDebugArtifacts(toUpload: string[], rootDir: string) {
       suffix += `-${entry[1]}`;
   }
   await artifact.create().uploadArtifact(
-    `${DEBUG_ARTIFACT_NAME}${suffix}`,
+    actionsUtil.sanitizeArifactName(`${DEBUG_ARTIFACT_NAME}${suffix}`),
     toUpload.map((file) => path.normalize(file)),
     path.normalize(rootDir)
   );