Merge pull request #66 from github/65-fix-code-scanning-alert---regular-expression-injection

resolved security finding by performing safety check on regexp from e…

node-scripts/branch-filter.js

@@ -1,9 +1,11 @@
 const core = require("@actions/core");
 const github = require("@actions/github");
+const lodash = require("lodash");
 
 (function start() {
   try {
     const issuePrefix = process.env?.ISSUE_PREFIX;
+    const safeIssuePrefix = lodash.escapeRegExp(issuePrefix);
     let ref = process.env?.BRANCH_NAME;
     if (!ref) {
       ref = github.context.ref;
@@ -11,7 +13,7 @@ const github = require("@actions/github");
     const branchName = ref.substring(ref.lastIndexOf("/") + 1);
     console.log(`branchName = ${branchName}`);
     core.setOutput("branchName", branchName);
-    const re = new RegExp("^" + issuePrefix + "(\\d+)");
+    const re = new RegExp("^" + safeIssuePrefix + "(\\d+)");
     const prefixMatches = branchName.match(re);
     let matches = "false";
     let issueNumber = "";