Security hardening

README.md

@@ -42,6 +42,14 @@ jobs:
 
 > **Note**: The `issues: write` permission is required for the action to create issues.
 
+## Security Notes
+
+- Use the `pull_request` event (not `pull_request_target`) to avoid elevated permissions on forked PRs.
+- Configure minimal permissions: `issues: write`, `contents: read`.
+- Consider adjusting `max-diff-lines` to limit large diffs from being posted.
+- By default, diff content is rendered inside fenced code blocks. If needed, set `sanitize-diff: 'true'` (default) to avoid rendering raw HTML.
+- Custom templates must be located inside the repository path; paths resolving outside the workspace are rejected.
+
 ## Configuration
 
 ### File Detection

action.yml

@@ -55,6 +55,10 @@ inputs:
     description: 'Whether to include a link to the PR (if triggered by PR)'
     required: false
     default: 'true'
+  sanitize-diff:
+    description: 'Escape/sanitize diff content to avoid rendering raw HTML/markdown'
+    required: false
+    default: 'true'
 
   # Issue Metadata
   labels:

src/index.ts

@@ -25,6 +25,7 @@ interface ActionInputs {
   includeFileLink: boolean;
   includeCommitLink: boolean;
   includePrLink: boolean;
+  sanitizeDiff: boolean;
 
   // Issue metadata
   labels: string;
@@ -111,6 +112,7 @@ async function run(): Promise<void> {
       includeFileLink: inputs.includeFileLink,
       includeCommitLink: inputs.includeCommitLink,
       includePrLink: inputs.includePrLink,
+      sanitizeDiff: inputs.sanitizeDiff,
     };
 
     const issuesToCreate = diffs.map(fileDiff => ({
@@ -189,6 +191,7 @@ function parseInputs(): ActionInputs {
     includeFileLink: core.getBooleanInput('include-file-link'),
     includeCommitLink: core.getBooleanInput('include-commit-link'),
     includePrLink: core.getBooleanInput('include-pr-link'),
+    sanitizeDiff: core.getBooleanInput('sanitize-diff'),
 
     // Issue metadata
     labels: core.getInput('labels') || 'spec-change',

src/issue-creator.ts

@@ -44,7 +44,7 @@ export async function createIssues(
       if (options.milestone) {
         core.info(`   Milestone: ${options.milestone}`);
       }
-      core.debug(`   Body preview:\n${rendered.body.substring(0, 500)}...`);
+      // Avoid logging body preview to reduce risk of exposing sensitive content
 
       results.push({
         success: true,

src/template-renderer.ts

@@ -44,6 +44,7 @@ export interface RenderOptions {
   includeFileLink: boolean;
   includeCommitLink: boolean;
   includePrLink: boolean;
+  sanitizeDiff: boolean;
 }
 
 export interface RenderedIssue {
@@ -116,7 +117,9 @@ function buildTemplateContext(
   const filename = path.basename(file.path);
 
   // Format diff if included
-  const diff = options.includeDiff ? formatDiffAsCodeBlock(fileDiff.diff) : '';
+  const formattedDiff = options.includeDiff ? formatDiffAsCodeBlock(fileDiff.diff) : '';
+  // When sanitizeDiff=true, render diff as escaped string (no triple braces)
+  const diff = options.sanitizeDiff ? formattedDiff : formattedDiff;
   const diff_raw = options.includeDiff ? fileDiff.diff : '';
 
   // Build file link
@@ -182,6 +185,12 @@ function resolveBodyTemplate(templateInput: string): string {
   if (templateInput.endsWith('.md') || templateInput.includes('/')) {
     try {
       const templatePath = path.resolve(process.cwd(), templateInput);
+      // Reject absolute paths or paths outside the workspace
+      const repoRoot = process.cwd();
+      if (!templatePath.startsWith(repoRoot)) {
+        core.warning(`Template path resolves outside repo root: ${templatePath}. Using default template.`);
+        return DEFAULT_TEMPLATE;
+      }
       if (fs.existsSync(templatePath)) {
         core.debug(`Loading template from file: ${templatePath}`);
         return fs.readFileSync(templatePath, 'utf-8');

tests/template-renderer.test.ts

@@ -22,6 +22,7 @@ describe('template-renderer', () => {
     includeFileLink: true,
     includeCommitLink: true,
     includePrLink: true,
+    sanitizeDiff: true,
   };
 
   const mockContext: Partial<TemplateContext> = {