[security] extra-args word-split + build-arg/label values echoed to logs; no tests #3

New issue

Closed

opened 2026-06-23 20:14:55 +00:00 by stephen · 0 comments

stephen commented

2026-06-23 20:14:55 +00:00

Owner

Autonomous security audit findings (HIGH).

build.sh:103-107 expands ${DBA_EXTRA_ARGS} UNQUOTED — glob + whitespace word-splitting, breaking the otherwise-safe argv model used for every other input (injection risk).
build.sh:110 prints the assembled command including --build-arg/--label values in plaintext to the build log (secret-in-build-arg leak).
Zero tests — no test dir, no CI workflow; arg assembly, digest regex, and login path are unexercised. Add a test stubbing docker on PATH and asserting argv (mirror create-pull-request-action's suite). Also: no docker logout leaves creds on shared runners (build.sh:43-49).

Autonomous security audit findings (HIGH). 1. `build.sh:103-107` expands `${DBA_EXTRA_ARGS}` UNQUOTED — glob + whitespace word-splitting, breaking the otherwise-safe argv model used for every other input (injection risk). 2. `build.sh:110` prints the assembled command including `--build-arg`/`--label` values in plaintext to the build log (secret-in-build-arg leak). 3. Zero tests — no test dir, no CI workflow; arg assembly, digest regex, and login path are unexercised. Add a test stubbing `docker` on PATH and asserting argv (mirror create-pull-request-action's suite). Also: no `docker logout` leaves creds on shared runners (`build.sh:43-49`).

stephen referenced this issue from a pull request that will close it,

2026-06-23 20:47:21 +00:00

[security] Quote extra-args, redact arg values in log, docker logout on exit #4

stephen closed this issue

2026-06-23 22:13:13 +00:00