fix: [M3-7081] - Quote variable in changeset shell command #9791
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description 📝
We're getting a codeQL warning for "Shell command built from environment values" for not properly handling the variable in the shell command.
Changes 🔄
Preview 📷
No visual change
How to test 🧪
If you have the codeQL extension on VSCode, you can set up a codeQL database for the manager repo and run the IncompleteSanitization.ql query (from the codeql repo - javascript >> ql >> src >> Security >> CWE-78 >> ShellCommandInjectionFromEnvironment.ql) on the manager database. Instructions for setting up the extension here: https://codeql.github.com/docs/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code/ (+ I also installed the CLI). guide
As an Author I have considered 🤔
Check all that apply
Commit message and pull request title format standards
<commit type>: [JIRA-ticket-number] - <description>
Commit Types:
feat
: New feature for the user (not a part of the code, or ci, ...).fix
: Bugfix for the user (not a fix to build something, ...).change
: Modifying an existing visual UI instance. Such as a component or a feature.refactor
: Restructuring existing code without changing its external behavior or visual UI. Typically to improve readability, maintainability, and performance.test
: New tests or changes to existing tests. Does not change the production code.upcoming
: A new feature that is in progress, not visible to users yet, and usually behind a feature flag.Example:
feat: [M3-1234] - Allow user to view their login history