surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Re-add log-issue-events workflow with security fixBrowse files

Re-implements the workflow removed in #5919, but with proper security:
- All GitHub event data is now passed via environment variables
- No direct templating of values into shell commands
- Prevents remote code execution through malicious issue titles
- Still escapes quotes in JSON payload for proper formatting

This fixes the security vulnerability while maintaining the functionality
of logging issue creation events to Statsig.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Boris Cherny authored on Aug 18, 2025 parent 4e63568 · commit 80ceacaa7821

1 changed file+40 -0compared with 4e63568

A.github/workflows/log-issue-events.yml

A.github/workflows/log-issue-events.yml+40 -0

		@@ -1,0 +1,40 @@
	1	+name: Log Issue Events to Statsig
	2	+
	3	+on:
	4	+ issues:
	5	+ types: [opened]
	6	+
	7	+jobs:
	8	+ log-to-statsig:
	9	+ runs-on: ubuntu-latest
	10	+ permissions:
	11	+ issues: read
	12	+ steps:
	13	+ - name: Log issue creation to Statsig
	14	+ env:
	15	+ STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}
	16	+ ISSUE_NUMBER: ${{ github.event.issue.number }}
	17	+ REPO: ${{ github.repository }}
	18	+ ISSUE_TITLE: ${{ github.event.issue.title }}
	19	+ AUTHOR: ${{ github.event.issue.user.login }}
	20	+ CREATED_AT: ${{ github.event.issue.created_at }}
	21	+ run: \|
	22	+ # All values are now safely passed via environment variables
	23	+ # No direct templating in the shell script to prevent injection attacks
	24	+
	25	+ curl -X POST "https://events.statsigapi.net/v1/log_event" \
	26	+ -H "Content-Type: application/json" \
	27	+ -H "statsig-api-key: $STATSIG_API_KEY" \
	28	+ -d '{
	29	+ "events": [{
	30	+ "eventName": "github_issue_created",
	31	+ "metadata": {
	32	+ "issue_number": "'"$ISSUE_NUMBER"'",
	33	+ "repository": "'"$REPO"'",
	34	+ "title": "'"$(echo "$ISSUE_TITLE" \| sed "s/\"/\\\\\"/g")"'",
	35	+ "author": "'"$AUTHOR"'",
	36	+ "created_at": "'"$CREATED_AT"'"
	37	+ },
	38	+ "time": '"$(date +%s)000"'
	39	+ }]
	40	+ }'