fix: Mitigate command injection risk in GitHub Actions workflow

[rohanday3]

What happens?

A command injection vulnerability exists in the GitHub Actions workflow. The workflow may execute unintended commands on the GitHub Actions runner when an issue is created or edited with a specially crafted title or body. This happens because user inputs are interpolated directly into run commands without proper sanitization.

Mini Showcase Repository (REQUIRED)

N/A (This issue is related to the current repository.)

How To Reproduce

Steps to reproduce the behavior:

https://github.com/rohanday3/qiankun

1. Create a new issue in the repository with the following title:

   • Issue Title: ";{echo,ZWNobyAiSW5qZWN0ZWQgQ29tbWFuZDogJChscyki}|{base64,-d}|{bash,-i};echo"

2. Observe the GitHub Actions workflow logs to verify if the injected command is executed. You should see output from the command if the injection is successful.

Expected Behavior

The workflow should safely handle user inputs by escaping or sanitizing them, preventing the execution of any injected commands.

Context

• qiankun Version: N/A
• Platform Version: GitHub Actions
• Browser Version: N/A

Additional Information

The provided payload demonstrates how command injection can occur when inputs are not properly sanitized. The example uses a base64-encoded payload to inject and execute commands in the workflow. Please refer to GitHub's security guidelines for more information on securing workflows: Security Hardening for GitHub Actions.

@DavidBakerEffendi

[github-actions]

由于缺乏足够的信息(github、stackblitz、codesandbox等可复现仓库)，我们暂时关闭了该 Issue。请修改（不要回复） Issue 提供最小重现以重新开启。谢谢。如果只是单独的技术咨询，可移步 https://qiankun.umijs.org/#-community 交流~