Skip to content

fix(security): pipe SSH command via stdin in digitalocean.sh (#3077) #3082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
la14-1 wants to merge 2 commits into from
+5 −1
Closed

fix(security): pipe SSH command via stdin in digitalocean.sh (#3077) #3082

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e75cdbc
fix(security): pipe SSH command via stdin in digitalocean.sh (#3077)
louisgv Mar 28, 2026
3e3d698
fix: revert stdin piping — preserve caller stdin for cloud_exec
louisgv Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion sh/e2e/lib/clouds/digitalocean.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ _digitalocean_exec() {
# Base64-encode the command to prevent shell injection when passed as an
# SSH argument. The encoded string contains only [A-Za-z0-9+/=] characters,
# making it safe to embed in single quotes. Stdin is preserved for callers
# that pipe data into cloud_exec.
# that pipe data into cloud_exec (e.g. verify.sh pipes data via stdin).
local encoded_cmd
encoded_cmd=$(printf '%s' "${cmd}" | base64 | tr -d '\n')

Expand All @@ -186,6 +186,10 @@ _digitalocean_exec() {
return 1
fi

# Pass the validated base64 payload inside single quotes in the SSH command.
# This is safe because base64 output ([A-Za-z0-9+/=]) cannot contain single
# quotes or any shell metacharacters. Stdin is NOT used here — callers may
# pipe their own data into cloud_exec (see verify.sh:245).
ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null \
-o ConnectTimeout=10 -o LogLevel=ERROR -o BatchMode=yes \
"root@${ip}" "printf '%s' '${encoded_cmd}' | base64 -d | bash"
Expand Down
Loading