NVIDIA / holodeck / 21997029007

48%

Build Type

push

github

Committed by web-flow

Commit Message

fix(security): validate node labels and IPs before shell interpolation (#656)

User-controlled label keys/values from YAML config were directly
interpolated into kubectl commands via fmt.Sprintf, enabling command
injection. Add label validation against Kubernetes label pattern.
Also validate PrivateIP with net.ParseIP before grep interpolation.

Audit findings #17 (MEDIUM), #18 (MEDIUM).

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Run Details

0 of 5 new or added lines in 1 file covered. (0.0%)

54 existing lines in 1 file now uncovered.

2593 of 5377 relevant lines covered (48.22%)

0.54 hits per line