aminghadersohi commented on code in PR #41396:
URL: https://github.com/apache/superset/pull/41396#discussion_r3614137355
##########
helm/superset/templates/_helpers.tpl:
##########
@@ -685,6 +685,14 @@ TALISMAN_CONFIG = {
{{- define "superset.initScript" -}}
#!/bin/sh
set -eu
+{{- if dig "istio" "terminateSidecarOnExit" false .Values.init }}
+# Notify the Istio pilot-agent sidecar to exit when this script completes
+# (whether successfully or via `set -e`), so that the Job can reach the
+# Completed state instead of hanging on a still-running envoy-proxy.
+# See https://github.com/apache/superset/issues/25798
+ISTIO_QUIT_ENDPOINT={{ dig "istio" "quitEndpoint"
"http://localhost:15020/quitquitquit"; .Values.init | squote }}
Review Comment:
`squote` doesn't escape embedded single quotes, so a `quitEndpoint` value
containing `'` still breaks out of the assignment — same class of bug as the
double-quote command-substitution issue just fixed in this PR, via single
quotes instead of double.
Verified:
```
helm template --set-string 'init.istio.quitEndpoint=http://x/quit'"'"'; echo
INJECTED; echo '"'"''
→ ISTIO_QUIT_ENDPOINT='http://x/quit'; echo INJECTED; echo ''
```
Not exploitable across a trust boundary (`quitEndpoint` is operator-set Helm
config), but it's a real gap in a fix whose commit message claims "no
metacharacters in the value are interpreted." Escape embedded quotes before the
outer `squote`:
```suggestion
ISTIO_QUIT_ENDPOINT={{ dig "istio" "quitEndpoint"
"http://localhost:15020/quitquitquit"; .Values.init | replace "'" "'\\''" |
squote }}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
