redhat-developer / redhat-developer/mapt
Avoid eval for externally supplied Tekton task parameters
@ppitonak is already working on this.
Since Jul 30, 2026.
- Dominant language
- Go
- Stars
- 24
- Forks
- 36
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 8
Description
Summary
Several AWS Tekton tasks construct a mapt command as a shell string and invoke it with eval. Parameters supplied to the Task can therefore be reinterpreted by the shell during evaluation rather than treated strictly as command arguments.
Required changes
Refactor the command construction in the affected AWS Tekton tasks to avoid eval and pass arguments directly using a safely quoted mechanism appropriate for the script shell (for example, a Bash argument array where Bash is available).
Affected areas:
tkn/template/infra-aws-ocp-snc.yamltkn/infra-aws-ocp-snc.yamltkn/template/infra-aws-rhel.yamltkn/infra-aws-rhel.yaml
Keep template and generated/deployed manifests consistent.
Rationale
Task parameters are externally supplied input. Evaluating an interpolated command string can allow shell syntax in parameter values (such as command substitutions, backticks, or quote characters) to alter command execution.
Acceptance criteria
- No affected task invokes a command assembled from Task parameters via
eval. - Task parameter values are passed as literal CLI arguments.
- The OCP SNC and RHEL template and deployed manifests remain behaviorally aligned.
- Existing supported create and destroy command options continue to be forwarded correctly.
Backlinks
- Originating PR: https://github.com/redhat-developer/mapt/pull/872
- Review discussion: https://github.com/redhat-developer/mapt/pull/872#discussion_r3678207674
- Requested by: @ppitonak
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.