From 8c38b1ccf84cb7880d371a696716ab70d9fea0ec Mon Sep 17 00:00:00 2001
From: Andrei Eternal <206184+Garoth@users.noreply.github.com>
Date: Thu, 4 Dec 2025 21:22:55 -0800
Subject: [PATCH] JB Integration Workflow: use pull_request_target to support
 remote remote PRs (#7917)

* JB Integration Workflow: use pull_request_target to support remote repo PRs

* also sanitize the branch name and title really hard to avoid json injections

* ok lets be extra double paranoid with the sanitization

* ok lets be even more extra safer by also not logging the head_ref

---------

Co-authored-by: Andrei Edell <andrei@nugbase.com>
---
 .github/workflows/trigger-jetbrains-tests.yml | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/trigger-jetbrains-tests.yml b/.github/workflows/trigger-jetbrains-tests.yml
index cd743322a1..6df187486f 100644
--- a/.github/workflows/trigger-jetbrains-tests.yml
+++ b/.github/workflows/trigger-jetbrains-tests.yml
@@ -1,6 +1,6 @@
 name: Trigger Jetbrains Plugin <-> Cline Tests
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
 permissions:
   contents: read
@@ -22,7 +22,24 @@ jobs:
           owner: cline
           repositories: intellij-plugin
 
+      - name: Sanitize untrusted inputs
+        id: sanitize
+        env:
+          RAW_BRANCH_NAME: ${{ github.head_ref }}
+          RAW_PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          # Sanitize branch name for JSON
+          BRANCH_NAME_JSON=$(jq -n --arg b "$RAW_BRANCH_NAME" '$b')
+          echo "branch_name=$BRANCH_NAME_JSON" >> $GITHUB_OUTPUT
+          
+          # Sanitize PR title for JSON
+          PR_TITLE_JSON=$(jq -n --arg t "$RAW_PR_TITLE" '$t')
+          echo "pr_title=$PR_TITLE_JSON" >> $GITHUB_OUTPUT
+
       - name: Trigger IntelliJ Plugin Integration Test
+        env:
+          BRANCH_NAME: ${{ steps.sanitize.outputs.branch_name }}
+          PR_TITLE: ${{ steps.sanitize.outputs.pr_title }}
         run: |
           curl -X POST \
             -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
@@ -35,10 +52,10 @@ jobs:
             "event_type": "cline-pr-check",
             "client_payload": {
               "pr_number": "${{ github.event.number }}",
-              "branch_name": "${{ github.head_ref }}",
+              "branch_name": $BRANCH_NAME,
               "action": "${{ github.event.action }}",
               "sha": "${{ github.event.pull_request.head.sha }}",
-              "pr_title": ${{ toJSON(github.event.pull_request.title) }},
+              "pr_title": $PR_TITLE,
               "pr_url": "${{ github.event.pull_request.html_url }}"
             }
           }
@@ -47,7 +64,6 @@ jobs:
       - name: Log trigger details
         run: |
           echo "Triggered IntelliJ Plugin integration test for:"
-          echo "  PR #${{ github.event.number }}: ${{ github.event.pull_request.title }}"
-          echo "  Branch: ${{ github.head_ref }}"
+          echo "  PR #${{ github.event.number }}"
           echo "  Action: ${{ github.event.action }}"
           echo "  SHA: ${{ github.event.pull_request.head.sha }}"