Copilot commented on code in PR #12839:
URL: https://github.com/apache/gluten/pull/12839#discussion_r3822530127
##########
dev/docker/Dockerfile.centos9-static-build:
##########
@@ -30,7 +32,7 @@ RUN set -ex; \
echo "check_certificate = off" >> ~/.wgetrc; \
yum install -y java-17-openjdk-devel patch git perl; \
dnf clean all; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos7-static-build:
##########
@@ -35,7 +38,7 @@ RUN set -ex; \
-e 's/mirror\.centos\.org/vault.centos.org/' \
/etc/yum.repos.d/CentOS-SCLo-scl-rh.repo; \
yum install -y git patch sudo java-1.8.0-openjdk-devel ccache; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos8-dynamic-build:
##########
@@ -44,7 +47,7 @@ RUN set -ex; \
wget -nv
${mirror_host}/celeborn/celeborn-0.6.3/apache-celeborn-0.6.3-bin.tgz?action=download
-O /opt/apache-celeborn-0.6.3-bin.tgz; \
wget -nv
${mirror_host}/uniffle/0.10.0/apache-uniffle-0.10.0-bin.tar.gz?action=download
-O /opt/apache-uniffle-0.10.0-bin.tar.gz; \
wget -nv
${mirror_host}/hadoop/common/hadoop-2.10.2/hadoop-2.10.2.tar.gz?action=download
-O /opt/hadoop-2.10.2.tar.gz; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos8-static-build:
##########
@@ -34,7 +36,7 @@ RUN set -ex; \
yum install -y java-1.8.0-openjdk-devel patch git perl; \
rpm -qa | grep tzdata; \
dnf clean all; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.almalinux8-gcc13-static-build:
##########
@@ -50,7 +53,7 @@ RUN set -ex; \
rm -f cmake-3.31.12-linux-$(uname -m).sh; \
echo "check_certificate = off" >> ~/.wgetrc; \
dnf clean all; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos7-gcc13-static-build:
##########
@@ -35,7 +38,7 @@ RUN set -ex; \
-e 's/mirror\.centos\.org/vault.centos.org/' \
/etc/yum.repos.d/CentOS-SCLo-scl-rh.repo; \
yum install -y git patch sudo java-1.8.0-openjdk-devel ccache curl; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos9-dynamic-build:
##########
@@ -36,7 +39,7 @@ RUN set -ex; \
mirror_host="https://www.apache.org/dyn/closer.lua";; \
wget -nv
${mirror_host}/celeborn/celeborn-0.5.4/apache-celeborn-0.5.4-bin.tgz?action=download
-O /opt/apache-celeborn-0.5.4-bin.tgz; \
wget -nv
${mirror_host}/celeborn/celeborn-0.6.3/apache-celeborn-0.6.3-bin.tgz?action=download
-O /opt/apache-celeborn-0.6.3-bin.tgz; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
##########
dev/docker/Dockerfile.centos8-gcc13-static-build:
##########
@@ -35,7 +37,7 @@ RUN set -ex; \
rm -f cmake-3.31.12-linux-$(uname -m).sh; \
rpm -qa | grep tzdata; \
dnf clean all; \
- git clone --depth=1 https://github.com/apache/gluten /opt/gluten; \
+ git clone --depth=1 --branch ${GLUTEN_BRANCH} ${GLUTEN_REPO} /opt/gluten; \
Review Comment:
`GLUTEN_BRANCH` and `GLUTEN_REPO` are expanded unquoted in a `RUN` shell
command, so a crafted build-arg value containing whitespace or shell
metacharacters (e.g., `;`) could change the command line or inject extra shell
commands during `docker build`. Quote these variables to prevent word-splitting
/ command injection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
