fix(aspera): agent potentially unsafe quoting

[odaysec]

ibmcloud-cos-cli/aspera/agent.go

Lines 157 to 173 in 1576fb4

	data := fmt.Sprintf(`{
	"transfer_requests": [
	{
	"transfer_request": {
	"paths": %s,
	"tags": {
	"aspera": {
	"node": {
	"storage_credentials": %s
	}
	}
	}
	}
	}
	]
	}
	`, jsonPaths, credentials)

Fix the issue should avoid directly embedding jsonPaths into the data string using fmt.Sprintf. Instead, we can construct the JSON object in a structured manner using Go's native JSON handling capabilities. This approach ensures that all special characters are properly escaped and avoids the risk of injection.

Specifically:

1. Replace the fmt.Sprintf construction of the data string with a structured approach using Go's map or struct types.
2. Use json.Marshal to serialize the entire data object into a JSON string, ensuring proper escaping and formatting.

References

SQL injection
Command Injection
CWE-78
CWE-89
CWE-94

[odaysec]

Signed-off-by: Zeroday BYTE [email protected]