security: prevent script injection in fuzz workflow (SonarCloud S7630)

The Fuzz step interpolated the user-controlled workflow_dispatch input ${{ inputs.fuzz_seconds }} directly into a run: shell command, allowing script injection by whoever triggers the workflow. Pass it via an env var (FUZZ_SECONDS) and reference "$FUZZ_SECONDS" so the value is treated as data, not shell. Resolves SonarCloud githubactions:S7630 (BLOCKER).
2026-10-21 22:54:11 -04:00 · 2026-10-21 17:08:18 -04:00
1 changed files with 3 additions and 1 deletions
@@ -427,7 +427,9 @@ jobs:
        run: cargo install cargo-fuzz --locked
      - name: Fuzz
        working-directory: crates/${{ matrix.target.crate }}
-        run: cargo fuzz run ${{ matrix.target.name }} ${{ matrix.target.args }} -- -max_total_time=${{ inputs.fuzz_seconds }}
+        env:
+          FUZZ_SECONDS: ${{ inputs.fuzz_seconds }}
+        run: cargo fuzz run ${{ matrix.target.name }} ${{ matrix.target.args }} -- -max_total_time="$FUZZ_SECONDS"
      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@v4