From f0d30abad401629645dd298eb8725704300cb743 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20Posp=C3=AD=C5=A1il?=
 <jiri.pospisil@unicorn.com>
Date: Sun, 9 Aug 2026 14:30:17 +0200
Subject: [PATCH] The game patch string is checked before it reaches a shell

CHANGED: The patch version read from `poe-tool-dev/latest-patch-version` must be a dotted number
and nothing else, or the run stops.

- It is another project's file, and from here it reached both `$GITHUB_OUTPUT` and a command
  line in a job that can write to this repository. A second line in it would have written a
  step output of its own; a metacharacter would have run in the build step.
- Tested with `[[ =~ ]]` rather than `grep`, which anchors per line and passes a string whose
  first line is a version.

CHANGED: The build step takes the patch string through the environment instead of interpolating
it into the script.

CHANGED: The data version is stamped once and reused for both `--data-version` and `--tag`. Two
`date` calls either side of UTC midnight would have tagged a bundle with a day its own manifest
disagrees with.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 95b201b..03bc3c6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,8 +39,17 @@ jobs:
       - name: Resolve game patch
         id: patch
         run: |
+          set -euo pipefail
           patch=$(curl -sS --fail --max-time 30 \
             https://raw.githubusercontent.com/poe-tool-dev/latest-patch-version/main/latest.txt)
+          # A dotted version and nothing else. This string is not ours — it comes out of another
+          # project's repository — and from here it reaches both a step output and a command
+          # line, so anything with a newline or a shell metacharacter in it stops the run.
+          # `[[ =~ ]]` and not `grep`, which anchors per line and would pass a second one.
+          if [[ ! "$patch" =~ ^[0-9]+(\.[0-9]+){0,4}$ ]]; then
+            echo "::error::refusing an unexpected patch string: $(printf '%q' "$patch")"
+            exit 1
+          fi
           echo "patch=$patch" >> "$GITHUB_OUTPUT"
           echo "Game patch: $patch"
 
@@ -87,13 +96,20 @@ jobs:
 
       - name: Build
         working-directory: builder
+        env:
+          PATCH: ${{ steps.patch.outputs.patch }} # via env, never interpolated into the script
+          RUN: ${{ github.run_number }}
         run: |
+          set -euo pipefail
+          # Stamped once: two `date` calls straddling UTC midnight would tag the bundle with a
+          # day the manifest inside it does not agree with.
+          ver="$(date -u +%Y%m%d).${RUN}"
           python -m ppcdata build \
             --out ../out --workdir .work \
-            --patch '${{ steps.patch.outputs.patch }}' \
+            --patch "$PATCH" \
             --allow-stale-wiki \
-            --data-version "$(date -u +%Y%m%d).${{ github.run_number }}" \
-            --tag "data-$(date -u +%Y%m%d).${{ github.run_number }}"
+            --data-version "$ver" \
+            --tag "data-$ver"
 
       - name: Verify
         working-directory: builder