redhat-developer / redhat-developer/mapt

Avoid eval for externally supplied Tekton task parameters

Open
#874 0 comments 0 reactions 1 assignee View on GitHub

@ppitonak is already working on this.

Since Jul 30, 2026.

Dominant language
Go
Stars
24
Forks
36
Avg merge
6d 13h
Merged PRs (30d)
8

Description

Summary

Several AWS Tekton tasks construct a mapt command as a shell string and invoke it with eval. Parameters supplied to the Task can therefore be reinterpreted by the shell during evaluation rather than treated strictly as command arguments.

Required changes

Refactor the command construction in the affected AWS Tekton tasks to avoid eval and pass arguments directly using a safely quoted mechanism appropriate for the script shell (for example, a Bash argument array where Bash is available).

Affected areas:

  • tkn/template/infra-aws-ocp-snc.yaml
  • tkn/infra-aws-ocp-snc.yaml
  • tkn/template/infra-aws-rhel.yaml
  • tkn/infra-aws-rhel.yaml

Keep template and generated/deployed manifests consistent.

Rationale

Task parameters are externally supplied input. Evaluating an interpolated command string can allow shell syntax in parameter values (such as command substitutions, backticks, or quote characters) to alter command execution.

Acceptance criteria

  • No affected task invokes a command assembled from Task parameters via eval.
  • Task parameter values are passed as literal CLI arguments.
  • The OCP SNC and RHEL template and deployed manifests remain behaviorally aligned.
  • Existing supported create and destroy command options continue to be forwarded correctly.

Backlinks

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.