[kdacosta0]

Jira: SECURESIGN-6182

The bug

tas-env-variables.sh derives a value from oc only when the variable is unset, for all six variables it manages. Both Windows scripts ignored what the caller had already set and unconditionally overwrote it.

This is not cosmetic. .github/workflows/e2e.yml exports TUF_URL, REKOR_URL, FULCIO_URL and REKOR_UI_URL from kubectl and then sources the env script. On Linux those survive; on Windows all four were discarded and re-derived from a cluster that may answer differently — or not at all.

For OIDC_ISSUER_URL the overwrite was worse than losing a value: the derived URL guesses the Keycloak realm path, and that guess only holds for RHBK, which serves under /realms. Legacy RH-SSO serves under /auth/realms, so a caller that knew its own issuer URL had it silently replaced with a wrong one.

Parity after this PR

Variable	.sh	.ps1	.bat
OIDC_ISSUER_URL	guarded	fixed	fixed
OIDC_CLIENT_ID	guarded	already guarded	already guarded
TUF_URL	guarded	fixed	fixed
FULCIO_URL	guarded	fixed	fixed
REKOR_URL	guarded	fixed	fixed
REKOR_UI_URL	guarded	fixed	fixed

All three scripts now have six guards each.

No Go code touched. A release-1.5 backport is #110.

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

Preserve caller-supplied URLs in Windows environment scripts

🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Preserve caller-supplied service and OIDC URLs in both Windows environment scripts.
• Derive missing URLs from OpenShift, using the admitted Keycloak route host for the issuer.
• Match the existing shell-script behavior without changing downstream exports.

Diagram

graph TD
  C["Caller variables"] --> S["Windows scripts"] --> D{"Value set?"}
  D -- "unset" --> O["OpenShift lookups"] --> E["Export variables"]
  O --> H["Admitted route host"] --> E
  D -- "set" --> E

Loading

High-Level Assessment

Guarding each lookup in its native script matches the existing shell behavior and avoids adding a shared bootstrap dependency for two small scripts. The batch file’s flat OIDC branch also avoids cmd.exe block-expansion pitfalls.

Files changed (2) +52 / -11

Bug fix (2) +52 / -11

tas-env-variables.batGuard batch URL lookups and use the admitted route host +12/-5

Guard batch URL lookups and use the admitted route host

• Keeps caller-provided TUF, OIDC issuer, Fulcio, Rekor, and Rekor UI URLs instead of replacing them with oc results. When the issuer is missing, reads the Keycloak host from route status and composes the default URL outside a parenthesized block.

tas-env-variables.bat

tas-env-variables.ps1Preserve supplied PowerShell URLs during bootstrap +40/-6

Preserve supplied PowerShell URLs during bootstrap

• Uses existing environment values for five URLs and queries OpenShift only when each is absent. A missing OIDC issuer now uses the route’s admitted host rather than its requested host.

tas-env-variables.ps1

[qodo-for-securesign]

Code Review by Qodo

View medium (1)

1. Caller URLs can run batch commands 🐞 Bug

Description

The new TUF_URL guard preserves caller input, but the batch script later expands that value into
unquoted set and echo commands; the other new guards likewise preserve values used in those
commands. When a supplied URL contains &, cmd.exe treats the text after it as another command,
so an ordinary query string is mishandled and a crafted value can execute a command while the script
runs.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new guards preserve caller-supplied URLs, but later batch commands expand those values as command text. A URL containing a command separator can be misparsed or execute another command.

## Fix Focus Areas
- tas-env-variables.bat[7-16]
- tas-env-variables.bat[21-41]

## Recommended Fix
Use `if defined`/`if not defined` for the guards rather than interpolating values into `if` comparisons. Make the downstream assignments and diagnostic output safe for caller-supplied URL characters, including `&` and quotes, while retaining the intended environment exports. Verify with a URL containing query parameters and with a crafted metacharacter value under `cmd.exe`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗