From d046a9bfdf5d03fbf478ee1bf984ce811b25cd93 Mon Sep 17 00:00:00 2001 From: A <258483684+la14-1@users.noreply.github.com> Date: Sun, 22 Mar 2026 18:41:50 -0700 Subject: [PATCH] fix: tighten character whitelist for cloud_headless_env values (#2890) The env value whitelist allowed @, %, +, =, :, and , characters that are unnecessary for cloud resource names (server names, regions, sizes) and could be used as shell metacharacters in certain contexts. Restrict to only [A-Za-z0-9._/-] which matches all legitimate cloud resource identifiers. Fixes #2883 Agent: code-health Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 --- sh/e2e/lib/provision.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sh/e2e/lib/provision.sh b/sh/e2e/lib/provision.sh index b90580ed..e510b2fa 100644 --- a/sh/e2e/lib/provision.sh +++ b/sh/e2e/lib/provision.sh @@ -102,8 +102,11 @@ provision_agent() { continue ;; esac - # Validate value against a safe character whitelist BEFORE export - if printf '%s' "${_env_val}" | grep -qE '[^A-Za-z0-9@%+=:,./_-]'; then + # Validate value: only allow characters that appear in cloud resource names + # (server names, regions, sizes). This strict whitelist rejects all shell + # metacharacters ($, `, ', ", ;, |, &, etc.) preventing command injection + # even if the cloud_headless_env function is compromised. + if printf '%s' "${_env_val}" | grep -qE '[^A-Za-z0-9._/-]'; then log_err "Invalid characters in env value for ${_env_name}" continue fi