NVIDIA / holodeck / 22714317868

50%

push

github

feat(templates): implement custom template loader and executor (#565) (#702)

* feat(templates): implement custom template loader and executor (#565)

LoadCustomTemplate supports inline, file, and URL sources with SHA256
checksum verification. CustomTemplateExecutor generates bash script
with env vars, logging, and continueOnError support.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

* fix(templates): address security review findings in custom template executor (#565)

- B1: Use single-quote shell quoting (shellQuote) for env var values to
  prevent command substitution injection via $(...)
- B2: Validate env var keys match ^[a-zA-Z_][a-zA-Z0-9_]*$ to prevent
  key injection
- R1: Move || true outside holodeck_log string so it acts as a shell
  operator, not part of the log message
- R2: Sanitize template name/phase before shell interpolation using
  sanitizeName() which strips non-alphanumeric characters
- N1: Detect 10MB URL response truncation instead of silently truncating
- N2: Update ContinueOnError test assertion to match corrected output

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

* fix(templates): fix raw string quoting in holodeck_log format strings (#565)

Revert escaped quotes inside Go backtick raw strings where \" was
literal backslash-quote instead of plain double quote.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

* fix(templates): address golangci-lint findings in custom template (#565)

- Wrap resp.Body.Close() to check error (errcheck)
- Use filepath.Clean before os.ReadFile (gosec G304)
- Use 0600 permissions for test WriteFile calls (gosec G306)

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

---------

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

78 of 103 new or added lines in 1 file covered. (75.73%)

2795 of 5654 relevant lines covered (49.43%)

0.56 hits per line