Summary
Several AWS Tekton tasks construct a mapt command as a shell string and invoke it with eval. Parameters supplied to the Task can therefore be reinterpreted by the shell during evaluation rather than treated strictly as command arguments.
Required changes
Refactor the command construction in the affected AWS Tekton tasks to avoid eval and pass arguments directly using a safely quoted mechanism appropriate for the script shell (for example, a Bash argument array where Bash is available).
Affected areas:
tkn/template/infra-aws-ocp-snc.yamltkn/infra-aws-ocp-snc.yamltkn/template/infra-aws-rhel.yamltkn/infra-aws-rhel.yaml
Keep template and generated/deployed manifests consistent.
Rationale
Task parameters are externally supplied input. Evaluating an interpolated command string can allow shell syntax in parameter values (such as command substitutions, backticks, or quote characters) to alter command execution.
Acceptance criteria
- No affected task invokes a command assembled from Task parameters via
eval.
- Task parameter values are passed as literal CLI arguments.
- The OCP SNC and RHEL template and deployed manifests remain behaviorally aligned.
- Existing supported create and destroy command options continue to be forwarded correctly.
Backlinks
Summary
Several AWS Tekton tasks construct a
maptcommand as a shell string and invoke it witheval. Parameters supplied to the Task can therefore be reinterpreted by the shell during evaluation rather than treated strictly as command arguments.Required changes
Refactor the command construction in the affected AWS Tekton tasks to avoid
evaland pass arguments directly using a safely quoted mechanism appropriate for the script shell (for example, a Bash argument array where Bash is available).Affected areas:
tkn/template/infra-aws-ocp-snc.yamltkn/infra-aws-ocp-snc.yamltkn/template/infra-aws-rhel.yamltkn/infra-aws-rhel.yamlKeep template and generated/deployed manifests consistent.
Rationale
Task parameters are externally supplied input. Evaluating an interpolated command string can allow shell syntax in parameter values (such as command substitutions, backticks, or quote characters) to alter command execution.
Acceptance criteria
eval.Backlinks