ruanwenjun commented on PR #18602: URL: https://github.com/apache/dolphinscheduler/pull/18602#issuecomment-5493651336
> The new `ProcessBuilder` argument array removes the shell-command concatenation, but the old apostrophe checks in `executeShellScript()` still reject legitimate arguments before they reach the script. > > For example, an alert title such as `Bob's workflow failed` or user parameters containing an apostrophe will still fail, even though apostrophes are safe when `scriptPath`, `title`, `content`, and `userParams` are passed as separate process arguments. This means the PR does not fully satisfy its stated behavior of passing arguments literally. > > Please remove the obsolete apostrophe-based rejection for `userParams`, `title`, and `content`. The existing injection test should then be updated to verify that shell metacharacters and apostrophes are delivered as literal argument values without executing additional commands. It would also be useful for the regression test to cover the whitespace-containing path from the linked issue, since the current path only contains `$(:)`. Done -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
