Skip to content

fix(CF-2507): list the shell-evaluated arguments of codefresh-run and helm - #739

Open
andrii-codefresh wants to merge 5 commits into
masterfrom
CF-2507-fix-interpolation-security
Open

andrii-codefresh wants to merge 5 commits into
masterfrom
CF-2507-fix-interpolation-security

Conversation

@andrii-codefresh

@andrii-codefresh andrii-codefresh commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

The engine substitutes Codefresh variables into step arguments as text, and these steps evaluate some arguments with a shell, so a branch name or a commit message could run commands.

The steps now list these arguments in spec.shellEvaluatedArguments with where each one goes into the shell command: unquoted, double-quoted or single-quoted. When the shellSafeGitVariables feature flag is on, the planner (ShellArguments) passes the Git variables in the listed arguments to the shell as environment variables. The argument schemas are the same as before.

pipeline-manager validates the new field, so release pipeline-manager before merging this PR.

… helm

The engine substitutes Codefresh variables into step arguments as text, and
these steps evaluate some arguments with a shell, so a branch name or a commit
message could run commands.

The arguments schemas now mark these arguments with "x-shell-evaluated"
("unquoted" or "double-quoted"). In the marked arguments the engine passes the
Git variables to the shell as environment variables. Engines without this
support ignore the keyword, so the steps work as before.
@andrii-codefresh

Copy link
Copy Markdown
Contributor Author

/e2e

This reverts commit 49f4542.
… helm in spec.shellEvaluatedArguments

Replace the x-shell-evaluated marks in the argument schemas with
spec.shellEvaluatedArguments, which pipeline-manager validates. The
argument schemas are the same as before.

The planner passes Git variables in the listed arguments as environment
variables, so the shell does not evaluate their values.
@andrii-codefresh andrii-codefresh changed the title fix(CF-2507): mark the shell-evaluated arguments of codefresh-run and helm fix(CF-2507): list the shell-evaluated arguments of codefresh-run and helm Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants