[code-scanning-fix] Fix go/unsafe-quoting: Use base64 encoding for project views

[github-actions]

Security Fix: Unsafe Quoting in Project Views Configuration

Alert Number: #538
Severity: Critical
Rule: go/unsafe-quoting
CWE: CWE-78, CWE-89, CWE-94

Vulnerability Description

CodeQL identified a potential unsafe quoting vulnerability in pkg/workflow/update_project_job.go at line 51. The code was using the %q format specifier to embed JSON data containing project views configuration into a YAML environment variable. While %q provides proper Go string escaping, it doesn't protect against potential injection if the value is later misused in shell contexts with single quotes, as JSON strings can contain unescaped single quotes.

Location

• File: pkg/workflow/update_project_job.go
• Line: 51
• Function: buildUpdateProjectJob

Fix Applied

Replaced the %q format specifier with base64 encoding for the GH_AW_PROJECT_VIEWS environment variable. Base64 encoding ensures that the value contains only alphanumeric characters plus +, /, and =, completely eliminating any possibility of quote-based injection attacks.

Changes Made:

1. Added base64 import to update_project_job.go
2. Modified line 50-51: Base64 encode the JSON before setting the environment variable
3. Added comprehensive tests in update_project_test.go:
   • TestUpdateProjectJob_ViewsConfigurationBase64: Tests base64 encoding with various special characters including single quotes, double quotes, and backslashes
   • TestUpdateProjectJob_Base64EncodingPreventsSQLInjection: Security test verifying that malicious input (SQL injection, command injection, variable expansion) is safely encoded

Before:

customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: %q\n", string(viewsJSON)))

After:

viewsBase64 := base64.StdEncoding.EncodeToString(viewsJSON)
customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: %s\n", viewsBase64))

Security Best Practices

This fix implements defense-in-depth security by:

1. Eliminating special characters: Base64 encoding ensures no quotes, backslashes, or shell metacharacters in the value
2. Preventing injection attacks: Even if the value is misused in shell contexts, it cannot break out of quoting
3. Maintaining functionality: The JavaScript consumer can easily decode the base64 value back to JSON
4. Future-proofing: Protects against potential misuse of this value in future code changes

Testing Considerations

The comprehensive test suite validates:

• ✅ Base64 encoding with simple names
• ✅ Handling of single quotes in view names
• ✅ Handling of double quotes and backslashes
• ✅ Multiple views with mixed special characters
• ✅ SQL injection attempts are encoded
• ✅ Command injection attempts are encoded
• ✅ Variable expansion attempts are encoded
• ✅ Decoded values match original configuration
• ✅ Base64 values contain only safe characters

All tests pass, demonstrating that the fix properly addresses the security vulnerability while maintaining correct functionality.

---

Automated by: Code Scanning Fixer Workflow
Run ID: 21268790203

AI generated by Code Scanning Fixer