fix(security): fix command injection and authorization bypass vulnerabilities [claude bot]

[Lin-Jiong-HDU]

Security Vulnerability Fixes

A security audit found 2 HIGH severity vulnerabilities that can be chained to allow an external unauthenticated attacker to execute arbitrary commands inside Docker containers and exfiltrate sensitive credentials. Please fix both.

---

Vuln 1: Command Injection — runner-image/entrypoint.sh:53

Problem: Line 53 of entrypoint.sh uses an unquoted heredoc delimiter <<SCRIPT (instead of <<'SCRIPT'), causing bash to perform parameter expansion and command substitution at heredoc creation time. ${ISSUE_TITLE} gets expanded, and this value is fully attacker-controlled (any GitHub user can create an issue in a public repo).

Attack chain: GitHub issue title → GitHub Actions workflow → CGate webhook → Docker env var → heredoc expansion → command execution

Fix: Quote the heredoc delimiter to prevent expansion; pass values through runtime environment variables instead:

cat > /tmp/run-claude.sh <<'SCRIPT'

Since ISSUE_TITLE and other variables are already environment variables, when su -s /bin/bash runner executes the script, the child process inherits them and expands them at runtime correctly. Also sanitize environment variable values in runner.go.

---

Vuln 2: Authorization Bypass — .github/workflows/issue-webhook.yml:13

Problem: The issue-webhook.yml workflow only checks if the issue title ends with [claude bot], but does not verify whether the issue author is a repository collaborator. Any GitHub user can create an issue in a public repo to trigger the full automation pipeline.

The CGate server-side (webhook_controller.go, task_usecase.go) also does not perform any authorization check on WebhookPayload.Author — it stores the value but never validates it.

Fix:

1. Add author permission check in the GitHub Actions workflow:

jobs:
  notify:
    if: >
      endsWith(github.event.issue.title, '[claude bot]') &&
      contains(fromJSON('["OWNER", "COLLABORATOR", "MEMBER"]'), github.event.issue.author_association)

2. Add an author allowlist validation on the server side in HandleWebhook (add an allowed_authors field in config) as defense in depth.

---

Acceptance Criteria

• entrypoint.sh heredoc uses quoted delimiter <<'SCRIPT' to prevent premature variable expansion
• Environment variable values passed to containers in runner.go are properly sanitized
• issue-webhook.yml adds author_association permission check
• Server-side webhook handler adds author allowlist validation
• All pipeline gates pass (go vet, go build, go test, golangci-lint run)