News for hackers. Stuff that matters.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by paulstovell on Tuesday November 03, 2020 @05:36PM (#24984824)
Octopus Deploy and TeamCity both parse output looking for commands in the same way (called Service Messages). I believe it is a common pattern in all CI servers.

The issue here doesn’t seem to be parsing the output, but what the parsed commands can do.

In Octopus there is no way to use them to run commands or set environment variables though. I can’t speak for TeamCity.

Update: TeamCity's documentation page about service messages:

https://www.jetbrains.com/help/teamcity/service-messages.htm...

The commands are quite specific though: test results, build numbers, etc. no generic commands like running commands or setting environment variables.

There are no comments on this comment yet.