From f7327dd2c6e610f8e7bc3fc4d3898344c53b6443 Mon Sep 17 00:00:00 2001
From: Muhammad Atif Ali <atif@coder.com>
Date: Wed, 2 Aug 2023 22:19:17 +0300
Subject: [PATCH] fix: avoid using comment body directly (#8851)

---
 .github/workflows/pr-deploy.yaml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-deploy.yaml b/.github/workflows/pr-deploy.yaml
index 646b7806d7..7b8b3bea69 100644
--- a/.github/workflows/pr-deploy.yaml
+++ b/.github/workflows/pr-deploy.yaml
@@ -234,9 +234,19 @@ jobs:
           if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
             experiments=${{ github.event.inputs.experiments }}
           else
-            experiments=$(echo "${{ github.event.comment.body }}" | grep -oP '(?<=--experiments )[^ ]+')
+            # extract experiments part
+            extracted_experiments=$(echo "$COMMENT_BODY" | grep -oP '(?<=--experiments )[^ ]+')
+            # Validate that the experiments is a comma-separated list of alphanumeric strings, "*", or "-"
+            if [[ $extracted_experiments =~ ^[a-zA-Z0-9_*,\"-]+$ ]]; then
+              experiments=$extracted_experiments
+            else
+              echo "Invalid input: $extracted_experiments"
+              exit 1
+            fi
           fi
           echo "experiments=$experiments" >> $GITHUB_OUTPUT
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body || '' }}
 
       - name: Create values.yaml
         run: |