The builder service passes user-controlled values directly to exec.CommandContext without input validation. A malicious repo URL or dockerfile path could inject shell arguments. Reported by gosec as G204 (CWE-78).
Affected:
apps/builder/internal/git/clone.go:23 — git clone with authedURL
apps/builder/internal/docker/build.go:67-72 — docker build with dockerfileBase
apps/builder/internal/docker/build.go:89-93 — docker login with credential variable
apps/builder/internal/docker/build.go:99 — docker push with tag
Fix:
Validate repoURL is a well-formed https://github.com/ URL before any exec call
Validate dockerfilePath contains no path traversal (../)
Restrict accepted URL schemes to https only — reject anything else
For docker auth: use Docker SDK (github.com/docker/docker/client) instead of shelling out to docker login
Add validation at the queue consumer entry point, before any downstream exec
The builder service passes user-controlled values directly to exec.CommandContext without input validation. A malicious repo URL or dockerfile path could inject shell arguments. Reported by gosec as G204 (CWE-78).
Affected:
apps/builder/internal/git/clone.go:23 — git clone with authedURL
apps/builder/internal/docker/build.go:67-72 — docker build with dockerfileBase
apps/builder/internal/docker/build.go:89-93 — docker login with credential variable
apps/builder/internal/docker/build.go:99 — docker push with tag
Fix:
Validate repoURL is a well-formed https://github.com/ URL before any exec call
Validate dockerfilePath contains no path traversal (../)
Restrict accepted URL schemes to https only — reject anything else
For docker auth: use Docker SDK (github.com/docker/docker/client) instead of shelling out to docker login
Add validation at the queue consumer entry point, before any downstream exec