Function validateExpressionSafety

pkg/workflow/expression_safety_validation.go:35–136

validateExpressionSafety checks that all GitHub Actions expressions in the markdown content are in the allowed list and returns an error if any unauthorized expressions are found

(markdownContent string)

// validateExpressionSafety checks that all GitHub Actions expressions in the markdown content
// are in the allowed list and returns an error if any unauthorized expressions are found
func validateExpressionSafety(markdownContent string) error {
	expressionValidationLog.Print("Validating expression safety in markdown content")

	matches := ExpressionPatternDotAll.FindAllStringSubmatch(markdownContent, -1)
	expressionValidationLog.Printf("Found %d expressions to validate", len(matches))

	var unauthorizedExpressions []string

	for _, match := range matches {
		if len(match) < 2 {
			continue
		}

		// Extract the expression content (everything between ${{ and }})
		expression := strings.TrimSpace(match[1])

		// Reject expressions that span multiple lines (contain newlines)
		if strings.Contains(match[1], "\n") {
			unauthorizedExpressions = append(unauthorizedExpressions, expression)
			continue
		}

		// Try to parse the expression using the parser
		parsed, parseErr := ParseExpression(expression)
		if parseErr == nil {
			// If we can parse it, validate each literal expression in the tree
			validationErr := VisitExpressionTree(parsed, func(expr *ExpressionNode) error {
				return validateSingleExpression(expr.Expression, ExpressionValidationOptions{
					NeedsStepsRe:            NeedsStepsPattern,
					InputsRe:                InputsPattern,
					WorkflowCallInputsRe:    WorkflowCallInputsPattern,
					AwInputsRe:              AWInputsPattern,
					AwImportInputsRe:        AWImportInputsPattern,
					EnvRe:                   EnvPattern,
					UnauthorizedExpressions: &unauthorizedExpressions,
				})
			})
			if validationErr != nil {
				return validationErr
			}
		} else {
			// If parsing fails, fall back to validating the whole expression as a literal
			err := validateSingleExpression(expression, ExpressionValidationOptions{
				NeedsStepsRe:            NeedsStepsPattern,
				InputsRe:                InputsPattern,
				WorkflowCallInputsRe:    WorkflowCallInputsPattern,
				AwInputsRe:              AWInputsPattern,
				AwImportInputsRe:        AWImportInputsPattern,
				EnvRe:                   EnvPattern,
				UnauthorizedExpressions: &unauthorizedExpressions,
			})
			if err != nil {
				return err
			}
		}
	}

	if len(unauthorizedExpressions) > 0 {