mirror of
https://github.com/shaka-project/shaka-player.git
synced 2026-06-26 17:46:26 +03:00
Joey Parrish
876511bad6
Workflows using gh api should always use -f (raw field) instead of -F (field including special characters) because a crafted message could be used to read files from the host, which could lead to things like leaked keys or other private information. There is no known exploit, because these messages were not yet controllable by an attacker as far as we know, but better safe than sorry. Discovered during a careful review of #9422, which adds new usage of gh api.