Question

A workflow triggered by pull_request builds a comment summarizing the PR. A step contains: `run: echo "PR says: ${{ github.event.pull_request.body }}"`. A security review flags this as a script-injection vector because an attacker can place shell metacharacters in the PR body. Which change most effectively mitigates the injection risk while still using the value in the run step?

Accepted Answer

Bind the untrusted value to an intermediate environment variable via the step's `env:` block, then reference it in the script as "$PR_BODY" (quoted shell variable).

Answer

Wrap the expression in single quotes: `run: echo 'PR says: ${{ github.event.pull_request.body }}'` so the shell treats it literally.

Answer

Set `permissions: contents: read` at the job level so the GITHUB_TOKEN cannot execute injected commands.

Answer

Switch the trigger to `pull_request_target` so the workflow runs with the base repository's context and neutralizes the payload.