Security Fix: Unsafe Quoting in Project Views Configuration

Alert Number: #538
Severity: Critical
Rule: go/unsafe-quoting
CWE: CWE-78 (OS Command Injection), CWE-89 (SQL Injection), CWE-94 (Code Injection)

Vulnerability Description

The code was constructing a shell environment variable by embedding JSON data directly into a single-quoted string without proper escaping. If the JSON data contained a single quote character, it could break out of the enclosing quotes and potentially allow command injection.

Vulnerable Code (Line 47):

customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", string(viewsJSON)))

If viewsJSON contains the character ', it would prematurely close the string literal and potentially execute arbitrary shell commands.

Location

• File: pkg/workflow/update_project_job.go
• Line: 47
• Function: buildUpdateProjectJob

Fix Applied

Added proper shell escaping for single quotes before embedding the JSON data into the environment variable string. The fix uses POSIX-compatible shell escaping:

1. Escape backslashes first: \ → \\ (prevents interference with quote escaping)
2. Escape single quotes: ' → '\'' (ends the quoted string, adds escaped quote, starts new quoted string)

Changes Made:

• Added strings import for string manipulation
• Replaced backslashes with double backslashes to prevent escape sequence interference
• Replaced single quotes with '\'' (POSIX shell escape sequence)
• Applied escaping to viewsJSON before embedding in the format string

Secure Code (Lines 48-52):

// Escape single quotes in JSON to prevent shell injection
// Replace backslashes first, then single quotes
escapedJSON := strings.ReplaceAll(string(viewsJSON), `\`, `\\`)
escapedJSON = strings.ReplaceAll(escapedJSON, `'`, `'\''`)
customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", escapedJSON))

Security Best Practices

This fix follows CodeQL's recommendations for handling potentially untrusted data:

1. Input Sanitization: Always escape special characters when embedding user-provided or dynamic data into shell commands
2. Defense in Depth: The escaping approach handles both backslashes and quotes to prevent complex injection attempts
3. POSIX Compliance: The '\'' technique works across all POSIX-compliant shells (bash, sh, zsh, etc.)
4. Preserve Functionality: The fix maintains the original behavior while preventing injection attacks

Testing Considerations

• Unit Tests: Consider adding tests with JSON data containing single quotes, backslashes, and other special characters
• Integration Tests: Test the workflow with project views that contain special characters in their configuration
• Security Testing: Verify that malicious input cannot break out of the quoted string

Automated by: Code Scanning Fixer Workflow
Run ID: 21263052463

AI generated by Code Scanning Fixer

Changeset

• Type: patch
• Description: Escape single quotes and backslashes when embedding JSON into shell environment variables to prevent shell injection (fixes go/unsafe-quoting).

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator