diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index 829b787e..e0d52f5a 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -34,10 +34,15 @@ jobs: - name: Commit generated pages # only update docs on non master if: ${{ github.ref != 'refs/heads/master' }} + env: + # Bind the untrusted PR branch name to an env var instead of interpolating + # ${{ github.head_ref }} into the shell script, where a branch name containing + # shell metacharacters would be executed as code (command injection). + HEAD_REF: ${{ github.head_ref }} run: | bundle exec rake dist git add docs cd docs git status git commit -am "Update dist" - git push origin HEAD:${{ github.head_ref }} --force + git push origin "HEAD:$HEAD_REF" --force diff --git a/docs/feed.xml b/docs/feed.xml index 00d5ff8a..238700ef 100644 --- a/docs/feed.xml +++ b/docs/feed.xml @@ -1,2 +1,2 @@ -Jekyll2026-06-01T08:26:39+00:00/feed.xmlHoliday Extras APIDocumentation to give to partners who would like to integrate with our API. +Jekyll2026-08-04T11:23:26+00:00/feed.xmlHoliday Extras APIDocumentation to give to partners who would like to integrate with our API. \ No newline at end of file diff --git a/docs/hxapi/asynchronous-bookings/index.html b/docs/hxapi/asynchronous-bookings/index.html index bde77c10..d4da9421 100644 --- a/docs/hxapi/asynchronous-bookings/index.html +++ b/docs/hxapi/asynchronous-bookings/index.html @@ -77,7 +77,7 @@

Availability Request

UK Products Availability Request

-