OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos

[dobsonj]

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

Similar story for test/k8s-integration. It doesn't grant any extra privs, and the 'command injection' refers to a temp directory path that is generated at runtime and is not actually controlled by a CLI arg.

 ✗ [Low] Command Injection
   ID: 1b0ac6fe-d500-4a32-a63f-1c09df4591b4 
   Path: test/k8s-integration/main.go, line 367 
   Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
 ✗ [Low] Command Injection
   ID: 3aed3256-a6e4-4bc8-8934-ec6625825517 
   Path: test/k8s-integration/main.go, line 383 
   Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
 ✗ [Low] Path Traversal
   ID: e435f443-d009-49ae-bd81-793d3f9e126f 
   Path: test/k8s-integration/main.go, line 565 
   Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
 ✗ [Low] Path Traversal
   ID: 7f43fb96-2bdd-4eef-bf4e-d155c2227a5d 
   Path: test/k8s-integration/main.go, line 576 
   Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
 ✗ [Low] Path Traversal
   ID: 291afee0-1ca9-4896-8ed0-13e7772c16bf 
   Path: test/k8s-integration/main.go, line 581 
   Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Low] Path Traversal
   ID: 68967f6e-634f-4182-878e-c00e8f714fe9 
   Path: test/k8s-integration/main.go, line 883 
   Info: Unsanitized input from a CLI argument flows into os.Open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
 ✗ [Medium] Path Traversal
   ID: 9274312f-6fbf-48c0-a3b3-81af876e84fa 
   Path: release-tools/boilerplate/boilerplate.py, line 59 
   Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: a5daf716-a3d1-4141-92f8-b362a675abdc 
   Path: release-tools/boilerplate/boilerplate.py, line 150 
   Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: a7c71885-e3f8-4d94-86bb-b8fd4404b724 
   Path: release-tools/filter-junit.go, line 98 
   Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: 33bfe6af-c2c1-412e-b247-5a4f83fde804 
   Path: release-tools/filter-junit.go, line 145 
   Info: Unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-gcp-pd-csi-driver-master-security/1745954191039270912

/cc @openshift/storage

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-27242, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (wduan@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

Similar story for test/k8s-integration. It doesn't grant any extra privs, and the 'command injection' refers to a temp directory path that is generated at runtime and is not actually controlled by a CLI arg.

✗ [Low] Command Injection
  ID: 1b0ac6fe-d500-4a32-a63f-1c09df4591b4 
  Path: test/k8s-integration/main.go, line 367 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Command Injection
  ID: 3aed3256-a6e4-4bc8-8934-ec6625825517 
  Path: test/k8s-integration/main.go, line 383 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Path Traversal
  ID: e435f443-d009-49ae-bd81-793d3f9e126f 
  Path: test/k8s-integration/main.go, line 565 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 7f43fb96-2bdd-4eef-bf4e-d155c2227a5d 
  Path: test/k8s-integration/main.go, line 576 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 291afee0-1ca9-4896-8ed0-13e7772c16bf 
  Path: test/k8s-integration/main.go, line 581 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Low] Path Traversal
  ID: 68967f6e-634f-4182-878e-c00e8f714fe9 
  Path: test/k8s-integration/main.go, line 883 
  Info: Unsanitized input from a CLI argument flows into os.Open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Medium] Path Traversal
  ID: 9274312f-6fbf-48c0-a3b3-81af876e84fa 
  Path: release-tools/boilerplate/boilerplate.py, line 59 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a5daf716-a3d1-4141-92f8-b362a675abdc 
  Path: release-tools/boilerplate/boilerplate.py, line 150 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a7c71885-e3f8-4d94-86bb-b8fd4404b724 
  Path: release-tools/filter-junit.go, line 98 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: 33bfe6af-c2c1-412e-b247-5a4f83fde804 
  Path: release-tools/filter-junit.go, line 145 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-gcp-pd-csi-driver-master-security/1745954191039270912

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dobsonj: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

Similar story for test/k8s-integration. It doesn't grant any extra privs, and the 'command injection' refers to a temp directory path that is generated at runtime and is not actually controlled by a CLI arg.

✗ [Low] Command Injection
  ID: 1b0ac6fe-d500-4a32-a63f-1c09df4591b4 
  Path: test/k8s-integration/main.go, line 367 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Command Injection
  ID: 3aed3256-a6e4-4bc8-8934-ec6625825517 
  Path: test/k8s-integration/main.go, line 383 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Path Traversal
  ID: e435f443-d009-49ae-bd81-793d3f9e126f 
  Path: test/k8s-integration/main.go, line 565 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 7f43fb96-2bdd-4eef-bf4e-d155c2227a5d 
  Path: test/k8s-integration/main.go, line 576 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 291afee0-1ca9-4896-8ed0-13e7772c16bf 
  Path: test/k8s-integration/main.go, line 581 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Low] Path Traversal
  ID: 68967f6e-634f-4182-878e-c00e8f714fe9 
  Path: test/k8s-integration/main.go, line 883 
  Info: Unsanitized input from a CLI argument flows into os.Open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Medium] Path Traversal
  ID: 9274312f-6fbf-48c0-a3b3-81af876e84fa 
  Path: release-tools/boilerplate/boilerplate.py, line 59 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a5daf716-a3d1-4141-92f8-b362a675abdc 
  Path: release-tools/boilerplate/boilerplate.py, line 150 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a7c71885-e3f8-4d94-86bb-b8fd4404b724 
  Path: release-tools/filter-junit.go, line 98 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: 33bfe6af-c2c1-412e-b247-5a4f83fde804 
  Path: release-tools/filter-junit.go, line 145 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-gcp-pd-csi-driver-master-security/1745954191039270912

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dobsonj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dobsonj: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[jsafrane]

/lgtm

[openshift-ci-robot]

@dobsonj: Jira Issue OCPBUGS-27242: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/vmware-vsphere-csi-driver-operator#213 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-27242 has not been moved to the MODIFIED state.

Details

In response to this:

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

Similar story for test/k8s-integration. It doesn't grant any extra privs, and the 'command injection' refers to a temp directory path that is generated at runtime and is not actually controlled by a CLI arg.

✗ [Low] Command Injection
  ID: 1b0ac6fe-d500-4a32-a63f-1c09df4591b4 
  Path: test/k8s-integration/main.go, line 367 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Command Injection
  ID: 3aed3256-a6e4-4bc8-8934-ec6625825517 
  Path: test/k8s-integration/main.go, line 383 
  Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
✗ [Low] Path Traversal
  ID: e435f443-d009-49ae-bd81-793d3f9e126f 
  Path: test/k8s-integration/main.go, line 565 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 7f43fb96-2bdd-4eef-bf4e-d155c2227a5d 
  Path: test/k8s-integration/main.go, line 576 
  Info: Unsanitized input from a CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Low] Path Traversal
  ID: 291afee0-1ca9-4896-8ed0-13e7772c16bf 
  Path: test/k8s-integration/main.go, line 581 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Low] Path Traversal
  ID: 68967f6e-634f-4182-878e-c00e8f714fe9 
  Path: test/k8s-integration/main.go, line 883 
  Info: Unsanitized input from a CLI argument flows into os.Open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.
✗ [Medium] Path Traversal
  ID: 9274312f-6fbf-48c0-a3b3-81af876e84fa 
  Path: release-tools/boilerplate/boilerplate.py, line 59 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a5daf716-a3d1-4141-92f8-b362a675abdc 
  Path: release-tools/boilerplate/boilerplate.py, line 150 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a7c71885-e3f8-4d94-86bb-b8fd4404b724 
  Path: release-tools/filter-junit.go, line 98 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: 33bfe6af-c2c1-412e-b247-5a4f83fde804 
  Path: release-tools/filter-junit.go, line 145 
  Info: Unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-gcp-pd-csi-driver-master-security/1745954191039270912

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-gcp-pd-csi-driver-container-v4.16.0-202401191549.p0.g587ce11.assembly.stream for distgit ose-gcp-pd-csi-driver.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-01-21-092529