Sanitize param usage in some plumbing task script blocks #977
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tekton-robot
added
the
size/L
Prior to this commit we had several script blocks using the syntax `$(params.foo)` to pull in param values. As per #971 it is advised to pull these usages into environment variables to improve robustness (unexpected characters in param values like quotes and ampersands can cause confusing issues when a script runs) and to remove one avenue of script injection in scenarios when a param includes user-submitted content. This PR patches resources in the cd, images, nightly-release, nightly-tests and release/base directories to move param referencing into environment variables.
6 tasks
jerop
approved these changes
Dec 23, 2021
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jerop The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
6 tasks
|
/lgtm |
|
/kind misc |
|
/test check-pr-has-kind-label |
afrittoli
reviewed
Jan 13, 2022
Comment on lines
+15
to
+21
| env: | ||
| - name: PACKAGE | ||
| value: $(params.package) | ||
| - name: VERSION | ||
| value: $(params.version) | ||
| - name: EXTRA_FILE | ||
| value: $(params.extra-file) |
There was a problem hiding this comment.
You cannot have an env directly under spec, it must either go into steps or into a stepTemplate.
afrittoli
reviewed
Jan 13, 2022
Comment on lines
+36
to
+44
| env: | ||
| - name: REMOTE_HOST | ||
| value: $(params.remote-host) | ||
| - name: REMOTE_USER | ||
| value: $(params.remote-user) | ||
| - name: REMOTE_PORT | ||
| value: $(params.remote-port) | ||
| - name: ACTION | ||
| value: $(params.action) |
afrittoli
reviewed
Jan 13, 2022
Comment on lines
+28
to
+34
| env: | ||
| - name: PACKAGE | ||
| value: $(params.package) | ||
| - name: VERSION_TAG | ||
| value: $(params.versionTag) | ||
| - name: RELEASE_BUCKET | ||
| value: $(params.releaseBucket) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Prior to this commit we had several script blocks using the syntax
$(params.foo)to pull in param values. As per #971it is advised to pull these usages into environment variables to
improve robustness (unexpected characters in param values like quotes and ampersands
can cause confusing issues when a script runs) and to remove
one avenue of script injection in scenarios when a param includes
user-submitted content.
This PR patches resources in the cd, images, nightly-release,
nightly-tests and release/base directories to move param referencing
into environment variables.
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide
for more details.