villebro opened a new pull request, #325:
URL: https://github.com/apache/superset-kubernetes-operator/pull/325
## Summary
A Claude security scan found two spots where an escaping helper was used in
a context it does not cover, letting a CR author inject code into generated
artifacts. Both are fixed by matching the quoting to the sink, with
defense-in-depth CRD constraints where applicable.
## Details
- **Valkey `keyPrefix` — Python f-string brace injection.** The cache
(`CACHE_KEY_PREFIX`, six sections) and results-backend (`key_prefix`) values
embedded `pyQuote`'s output *inside a Python f-string*. `pyQuote`
(strconv.Quote semantics) escapes quotes and backslashes but not braces, so
`keyPrefix: "{SECRET_KEY}"` interpolated the live secret into every cache key
(a secret-exfiltration channel into a possibly-shared Valkey), and
`{__import__('os').system(...)}` executed arbitrary Python at config import in
every component and lifecycle-task pod. The prefix is now rendered as a
separate plain string literal concatenated onto the instance f-string —
`f"{_superset_instance}_" + "<pyQuoted>"` — so braces are inert. Both
`keyPrefix` fields gain `Pattern` (`^[A-Za-z0-9._:-]*$`) and `MaxLength=128`
markers, and `FuzzRenderConfig` now asserts no user prefix is ever interpolated
into the instance f-string.
- **Seed `excludeTables`/`excludeTableData`/`postSeedSQL` — shell
injection.** The generated `pg_dump`/`mysqldump` scripts spliced these fields
with Go `%q`, which produces double-quoted strings where `$` and backticks stay
shell-active, so a table name like `x$(cmd)` executed in the seed container
(which holds source and target DB credentials). Every splice now uses the
package's existing `shellQuote` helper (single-quoted), matching the deliberate
escaping discipline used elsewhere in the same scripts.
## Release notes
- `keyPrefix` values are now constrained to `^[A-Za-z0-9._:-]*$` (max 128
chars); the safer rendering causes a one-time config-checksum change and pod
roll on upgrade.
- Seed `excludeTables`/`excludeTableData`/`postSeedSQL` values are now
passed literally (single-quoted); any value that previously relied on shell
expansion no longer expands.
Found via a Claude security scan.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
