security: validate apt package names and require a whole-string semver (#72)

* security: validate apt package names and require a whole-string semver

* install-apt-packages: disable globbing and reject slashes in package names

actions/install-apt-packages/action.yml

@@ -20,7 +20,16 @@ runs:
         PACKAGES: ${{ inputs.packages }}
       run: |
         set -euo pipefail
+        # No globbing: an unquoted token like foo* must not expand to workspace filenames.
+        set -f
         list=$(printf '%s\n' $PACKAGES | sort -u | tr '\n' ' ')
+        # Tokens become apt-get operands: a leading dash would be an option (-o runs commands).
+        for pkg in $list; do
+          if [[ ! "$pkg" =~ ^[A-Za-z0-9][A-Za-z0-9.+:=~_-]*$ ]]; then
+            echo "::error::install-apt-packages: invalid package name '$pkg'"
+            exit 1
+          fi
+        done
         if [ -z "${list// /}" ]; then
           echo "::error::install-apt-packages: no packages given"
           exit 1
@@ -58,7 +67,7 @@ runs:
               -o APT::Keep-Downloaded-Packages=true -o APT::Sandbox::User=root)
         sudo apt-get "${opts[@]}" update
         # shellcheck disable=SC2086 # the list is split into package names on purpose
-        sudo apt-get "${opts[@]}" install -y --no-install-recommends $PACKAGE_LIST
+        sudo apt-get "${opts[@]}" install -y --no-install-recommends -- $PACKAGE_LIST
         sudo apt-get "${opts[@]}" autoclean
         sudo chown -R "$(id -u):$(id -g)" "$debs"
 

actions/resolve-version/action.yml

@@ -40,7 +40,9 @@ runs:
         v="$INPUT_VERSION"
         v="${v#v}"
         v="${v:-$VERSION}"
-        if ! printf '%s' "$v" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
+        # Whole-string match: grep would accept a multi-line input with one valid line.
+        semver='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+        if [[ ! "$v" =~ $semver ]]; then
           echo "::error::'$v' is not a version like 1.2.3 or 1.2.3-rc.1"
           exit 1
         fi