codeant-ai-for-open-source[bot] commented on code in PR #41396:
URL: https://github.com/apache/superset/pull/41396#discussion_r3606650575
##########
helm/superset/templates/_helpers.tpl:
##########
@@ -685,6 +685,13 @@ TALISMAN_CONFIG = {
{{- define "superset.initScript" -}}
#!/bin/sh
set -eu
+{{- if dig "istio" "terminateSidecarOnExit" false .Values.init }}
+# Notify the Istio pilot-agent sidecar to exit when this script completes
+# (whether successfully or via `set -e`), so that the Job can reach the
+# Completed state instead of hanging on a still-running envoy-proxy.
+# See https://github.com/apache/superset/issues/25798
+trap 'rc=$?; curl -fsS -m 5 -X POST {{ dig "istio" "quitEndpoint"
"http://localhost:15020/quitquitquit"; .Values.init | quote }} >/dev/null 2>&1
|| true; exit $rc' EXIT
Review Comment:
**Suggestion:** The configured `quitEndpoint` is injected into a
double-quoted shell argument, which still allows command substitution (`$(...)`
or backticks) at runtime. If this value is ever set from untrusted or templated
input, it can execute arbitrary shell commands in the init container. Render
the endpoint as a shell-safe single-quoted literal (or otherwise escape
`$`/backticks) before embedding it in the trap command. [security]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Init-db job shell injection via quitEndpoint command substitution.
- ⚠️ Init container can run unintended commands during initialization.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
4. Deploy the chart so that the init-db Job runs: the init container command
in
`helm/superset/templates/init-job.yaml` at line ~111 (`command: {{ tpl
(toJson
.Values.init.command) . }}`) sources the generated `superset_init.sh` (see
`values.yaml`
init.command lines 19–24 in the "Showing lines 910 to 989" block); when the
script
completes, the `EXIT` trap executes, and the shell evaluates the
double-quoted
`quitEndpoint`, causing the injected `$(touch /tmp/pwned)` (or other command
substitution)
to run inside the init container.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=95f9ed3123a244bdb7a6f0d2e4638076&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=95f9ed3123a244bdb7a6f0d2e4638076&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** helm/superset/templates/_helpers.tpl
**Line:** 693:693
**Comment:**
*Security: The configured `quitEndpoint` is injected into a
double-quoted shell argument, which still allows command substitution (`$(...)`
or backticks) at runtime. If this value is ever set from untrusted or templated
input, it can execute arbitrary shell commands in the init container. Render
the endpoint as a shell-safe single-quoted literal (or otherwise escape
`$`/backticks) before embedding it in the trap command.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41396&comment_hash=8a20641e25ce9e80ee2c657ec83d76310ed4fc36c3c2716c233bc35c80a6e92f&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41396&comment_hash=8a20641e25ce9e80ee2c657ec83d76310ed4fc36c3c2716c233bc35c80a6e92f&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
