public_git
/
helmfile
mirror of https://github.com/helmfile/helmfile.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add shell escaping for kubeContext in TemplateArgs 

Addressed code review feedback to properly quote the kubeContext value
using shellescape.Quote() to prevent potential command injection if the
context name contains spaces or special characters. Also added clearer
comments explaining the string matching logic for existing flags.

Co-authored-by: yxxhero <11087727+yxxhero@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2025-12-08 07:55:36 +00:00
parent 3ef595ba19
commit e11ef412f5
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/state/state.go
View File

@ -20,6 +20,7 @@ import (
"text/template"
"time"
shellescape "al.essio.dev/pkg/shellescape"
"dario.cat/mergo"
"github.com/Masterminds/semver/v3"
"github.com/gofrs/flock"
@ -1433,12 +1434,17 @@ func (st *HelmState) processChartification(chartification *Chartify, release *Re
}
if kubeContext != "" {
// Build the template args with proper quoting for the kubeContext value
// Use shellescape to safely quote the context name in case it contains special characters
quotedContext := shellescape.Quote(kubeContext)
if chartifyOpts.TemplateArgs == "" {
chartifyOpts.TemplateArgs = fmt.Sprintf("--kube-context %s --dry-run=server", kubeContext)
chartifyOpts.TemplateArgs = fmt.Sprintf("--kube-context %s --dry-run=server", quotedContext)
} else {
// Only add --kube-context if not already present
if !strings.Contains(chartifyOpts.TemplateArgs, "--kube-context") {
chartifyOpts.TemplateArgs = fmt.Sprintf("--kube-context %s %s", kubeContext, chartifyOpts.TemplateArgs)
chartifyOpts.TemplateArgs = fmt.Sprintf("--kube-context %s %s", quotedContext, chartifyOpts.TemplateArgs)
}
// Add --dry-run if not already present
if !strings.Contains(chartifyOpts.TemplateArgs, "--dry-run") {
chartifyOpts.TemplateArgs += " --dry-run=server"
}