Why is this an issue?
Shell commands in internal/repositories/k8s/provisioner.go are built using unsafe string concatenation at lines 379, 510, 522, 629. This enables potential command injection if variables contain malicious content.
What is causing it?
exec.Run(ctx, "cat "+adminKubeconfig)
exec.Run(ctx, "kubectl --kubeconfig "+adminKubeconfig+" get nodes")
The code uses shellQuote() in other places but this pattern is inconsistently applied.
How can it be solved?
Use shellQuote() consistently or exec.Command() with separate arguments.
Category
Severity
Why is this an issue?
Shell commands in
internal/repositories/k8s/provisioner.goare built using unsafe string concatenation at lines 379, 510, 522, 629. This enables potential command injection if variables contain malicious content.What is causing it?
The code uses
shellQuote()in other places but this pattern is inconsistently applied.How can it be solved?
Use
shellQuote()consistently orexec.Command()with separate arguments.Category
Severity