1
25%
master: 25%

Ran 06 May 2026 10:01AM UTC

Files 208

Run time 10s

Badge

Embed ▾

Committed 06 May 2026 09:57AM UTC coverage: 24.835% (-0.002%) from 24.837%

Job # 25428568791.1

Build Type

push

github

Committed by

web-flow

Commit Message

refactor(security): pass argv to exec instead of shell concatenation (#6700)

Three exec sites previously joined arguments into a single shell string
and ran them via "bash -c"/"sh -xc". Although every field reaching these
calls is currently validated (net.ParseIP, port ints, protocol whitelists),
the shell-concat pattern is fragile and was acknowledged with a TODO in
vpc_nat_gateway.go. Pass arguments directly as argv so the kubelet exec
API and os/exec deliver them without shell parsing.

- ovs_linux.go: split the UFO probe and disable into two direct ethtool
  exec calls. Treat probe failure as a best-effort skip to keep the prior
  shell behavior on devices/kernels that reject ``ethtool -k``.
- vpc_nat_gateway.go / service_lb.go: build an argv slice and pass it
  directly to ExecuteCommandInContainer; drop the existing TODO.
- nat-gateway.sh / lb-svc.sh: dispatch via ``shift`` + ``"\$@"``. Use
  ``"\$*"`` for nat-gateway.sh ``init`` so the documented
  ``init net1, net2`` form still works.

Inspired by flannel-io/flannel#2400.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

14074 of 56669 relevant lines covered (24.84%)

0.29 hits per line

kubeovn / kube-ovn / 25428568791 / 1
25%
master: 25%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 25428568791.1

kubeovn / kube-ovn / 25428568791 / 1 25% master: 25%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 25428568791.1

kubeovn / kube-ovn / 25428568791 / 1
25%
master: 25%

README BADGES
x