kubeovn / kube-ovn / 25428568791

25%

Build Type

push

github

Committed by web-flow

Commit Message

refactor(security): pass argv to exec instead of shell concatenation (#6700)

Three exec sites previously joined arguments into a single shell string
and ran them via "bash -c"/"sh -xc". Although every field reaching these
calls is currently validated (net.ParseIP, port ints, protocol whitelists),
the shell-concat pattern is fragile and was acknowledged with a TODO in
vpc_nat_gateway.go. Pass arguments directly as argv so the kubelet exec
API and os/exec deliver them without shell parsing.

- ovs_linux.go: split the UFO probe and disable into two direct ethtool
  exec calls. Treat probe failure as a best-effort skip to keep the prior
  shell behavior on devices/kernels that reject ``ethtool -k``.
- vpc_nat_gateway.go / service_lb.go: build an argv slice and pass it
  directly to ExecuteCommandInContainer; drop the existing TODO.
- nat-gateway.sh / lb-svc.sh: dispatch via ``shift`` + ``"\$@"``. Use
  ``"\$*"`` for nat-gateway.sh ``init`` so the documented
  ``init net1, net2`` form still works.

Inspired by flannel-io/flannel#2400.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

0 of 23 new or added lines in 3 files covered. (0.0%)

2 existing lines in 1 file now uncovered.

14074 of 56669 relevant lines covered (24.84%)

0.29 hits per line