NVIDIA / holodeck / 22713299226

49%

main: 50%

push

github

fix(templates): address security review findings in custom template executor (#565)

- B1: Use single-quote shell quoting (shellQuote) for env var values to
  prevent command substitution injection via $(...)
- B2: Validate env var keys match ^[a-zA-Z_][a-zA-Z0-9_]*$ to prevent
  key injection
- R1: Move || true outside holodeck_log string so it acts as a shell
  operator, not part of the log message
- R2: Sanitize template name/phase before shell interpolation using
  sanitizeName() which strips non-alphanumeric characters
- N1: Detect 10MB URL response truncation instead of silently truncating
- N2: Update ContinueOnError test assertion to match corrected output

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

21 of 25 new or added lines in 1 file covered. (84.0%)

2735 of 5591 relevant lines covered (48.92%)

0.55 hits per line