Prevent script injection from input

Author: onizet

.github/workflows/publish_nuget.yml

@@ -32,6 +32,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      # validate the input.version as Github do not yet support regex validation
+      - name: Validate version input
+        run: |
+          REGEXP="^[1-9]{1,2}.[0-9]+.[0-9]+(-beta\d+)?$"
+          if [[ ! "$UNTRUSTED_INPUT" =~ $REGEXP ]]; then
+            echo "::error:: Invalid version format"
+            exit 1
+          fi
+        env:
+         UNTRUSTED_INPUT: ${{ github.event.inputs.version }}
+
       - uses: actions/checkout@v6
 
       # Only validate tag is on master for auto-triggered runs