From ddbbbbb945232a1c163388a85de7346475beb39c Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Thu, 22 Oct 2026 16:34:57 -0700 Subject: [PATCH] docs(cse_main): document risk-acceptance for unquoted OUTBOUND_COMMAND OUTBOUND_COMMAND is expanded unquoted in a retrycmd_if_failure call, which a scanner flags as a command-injection-shaped pattern. This is intentional, not an oversight: - It is a full shell command (e.g. a curl connectivity check) built by the RP from config.OutboundType/CloudSpecConfig (GetOutboundCommand in pkg/agent/baker.go), not an arbitrary string from an external/ customer-controlled input. - Quoting it would break word-splitting into argv, making the outbound connectivity preflight check fail to execute as intended. No functional change - in-place comment only, documenting why this should not be 'fixed' by naively adding quotes. Verified: bash -n passes, and the full cse_main_spec.sh ShellSpec suite still passes (17 examples, 0 failures) - including the static assertions on this exact line's format and ordering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981 --- parts/linux/cloud-init/artifacts/cse_main.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/parts/linux/cloud-init/artifacts/cse_main.sh b/parts/linux/cloud-init/artifacts/cse_main.sh index 0c3ffe92253..359660c467d 100755 --- a/parts/linux/cloud-init/artifacts/cse_main.sh +++ b/parts/linux/cloud-init/artifacts/cse_main.sh @@ -457,6 +457,12 @@ function nodePrep { fi if [ -n "${OUTBOUND_COMMAND}" ]; then + # OUTBOUND_COMMAND is intentionally expanded unquoted here (not a scanner oversight): + # it is a full shell command (e.g. `curl -v --insecure --proxy-insecure `) built by + # the RP from config.OutboundType/CloudSpecConfig (see GetOutboundCommand in baker.go), + # not an arbitrary string from an external caller. Quoting it would break word-splitting + # into argv and make the outbound connectivity check fail to execute. Do not add quotes + # here without also changing it to an array (e.g. OUTBOUND_COMMAND=(...)) end to end. retrycmd_if_failure 20 1 15 $OUTBOUND_COMMAND >> /var/log/azure/cluster-provision-cse-output.log 2>&1 || exit $ERR_OUTBOUND_CONN_FAIL; fi if [ -n "${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}" ]; then