Skip to content

Commit cd83220

Browse files
riley-dixonriley-dixon
committed
CI: Security harden strings using AIS variables
Further try to harden against shell injection by wrapping use of AIS variables in double-quotes.
1 parent dff9289 commit cd83220

5 files changed

Lines changed: 60 additions & 60 deletions

File tree

‎.github/workflows/build-ais-ci-image.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85,14 +85,14 @@ jobs:
8585
- name: Build base image for AIS CI
8686
run: |
8787
docker buildx build \
88-
-f ${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${AIS_CI_IMAGE_NAME} \
88+
-f "${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${AIS_CI_IMAGE_NAME}" \
8989
--label "org.opencontainers.image.description= \
9090
${AIS_CI_IMAGE_NAME} Development Image for AIS CI using branch \
9191
${{ github.head_ref }} for PR #${AIS_PR_NUMBER}. \
9292
PR URL: ${AIS_PR_BASE_URL}/${AIS_PR_NUMBER}" \
9393
--build-arg BUILDKIT_INLINE_CACHE=1 \
94-
--cache-from=type=registry,ref=${{ steps.ci-image.outputs.AIS_CI_IMAGE }} \
95-
--cache-from=type=registry,ref=${{ steps.ci-image.outputs.AIS_CI_LATEST_CACHE }} \
94+
--cache-from=type=registry,ref="${{ steps.ci-image.outputs.AIS_CI_IMAGE }}" \
95+
--cache-from=type=registry,ref="${{ steps.ci-image.outputs.AIS_CI_LATEST_CACHE }}" \
9696
--push \
97-
-t ${{ steps.ci-image.outputs.AIS_CI_IMAGE }} \
97+
-t "${{ steps.ci-image.outputs.AIS_CI_IMAGE }}" \
9898
${GITHUB_WORKSPACE}

‎.github/workflows/build-ais-nvidia.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,14 @@ jobs:
5555
--rm \
5656
--pull always \
5757
-v ${GITHUB_WORKSPACE}:/mnt/ais:ro \
58-
-v ${AIS_MOUNT_PATH}:/mnt/ais-fs \
59-
--name ${AIS_CONTAINER_NAME} \
60-
${AIS_INPUT_CI_IMAGE}
58+
-v "${AIS_MOUNT_PATH}:/mnt/ais-fs" \
59+
--name "${AIS_CONTAINER_NAME}" \
60+
"${AIS_INPUT_CI_IMAGE}"
6161
- name: Make copy of the code repository and create build directories
6262
run: |
6363
docker exec \
6464
-t \
65-
${AIS_CONTAINER_NAME} \
65+
"${AIS_CONTAINER_NAME}" \
6666
/bin/bash -c '
6767
cp -R /mnt/ais /ais
6868
mkdir /ais/hipFile/build
@@ -73,10 +73,10 @@ jobs:
7373
-e "_AIS_INPUT_CXX_COMPILER=${AIS_INPUT_CXX_COMPILER}" \
7474
-t \
7575
-w /ais/hipFile/build \
76-
${AIS_CONTAINER_NAME} \
76+
"${AIS_CONTAINER_NAME}" \
7777
/bin/bash -c '
7878
cmake \
79-
-DCMAKE_CXX_COMPILER=${_AIS_INPUT_CXX_COMPILER} \
79+
-DCMAKE_CXX_COMPILER="${_AIS_INPUT_CXX_COMPILER}" \
8080
-DCMAKE_CXX_FLAGS="-Werror" \
8181
-DCMAKE_HIP_PLATFORM=nvidia \
8282
-DAIS_BUILD_DOCS=ON \
@@ -87,7 +87,7 @@ jobs:
8787
docker exec \
8888
-t \
8989
-w /ais/hipFile/build \
90-
${AIS_CONTAINER_NAME} \
90+
"${AIS_CONTAINER_NAME}" \
9191
/bin/bash -c '
9292
cmake --build . --parallel
9393
'
@@ -96,14 +96,14 @@ jobs:
9696
docker exec \
9797
-t \
9898
-w /ais/hipFile \
99-
${AIS_CONTAINER_NAME} \
99+
"${AIS_CONTAINER_NAME}" \
100100
/bin/bash -c '
101101
rm -rf build/*
102102
'
103103
- name: Cleanup & Stop the Docker container
104104
if: ${{ always() }}
105105
run: |
106-
docker stop ${AIS_CONTAINER_NAME}
106+
docker stop "${AIS_CONTAINER_NAME}"
107107
### Disable until NVIDIA runners come back
108108
# Run_hipFile_NVIDIA:
109109
# uses: ./.github/workflows/hipfile-nvidia.yml

‎.github/workflows/build-ais.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -87,16 +87,16 @@ jobs:
8787
--pull always \
8888
-v ${GITHUB_WORKSPACE}:/mnt/ais:ro \
8989
-v "${AIS_GHA_CMD_FILES_DIR}:${AIS_GHA_CMD_FILES_DOCKER_DIR}" \
90-
-v ${AIS_MOUNT_PATH}:/mnt/ais-fs \
91-
--name ${AIS_CONTAINER_NAME} \
92-
${AIS_INPUTS_CI_IMAGE}
90+
-v "${AIS_MOUNT_PATH}:/mnt/ais-fs" \
91+
--name "${AIS_CONTAINER_NAME}" \
92+
"${AIS_INPUT_CI_IMAGE}"
9393
- name: Make copy of the code repository and create build directories
9494
# Single quotes necessary to ensure string/command substitutions happen
9595
# in the container and not on the host.
9696
run: |
9797
docker exec \
9898
-t \
99-
${AIS_CONTAINER_NAME} \
99+
"${AIS_CONTAINER_NAME}" \
100100
/bin/bash -c '
101101
cp -R /mnt/ais /ais
102102
mkdir /ais/hipFile/build
@@ -107,10 +107,10 @@ jobs:
107107
-e "_AIS_INPUT_CXX_COMPILER=${AIS_INPUT_CXX_COMPILER}" \
108108
-t \
109109
-w /ais/hipFile/build \
110-
${AIS_CONTAINER_NAME} \
110+
"${AIS_CONTAINER_NAME}" \
111111
/bin/bash -c '
112112
cmake \
113-
-DCMAKE_CXX_COMPILER=${_AIS_INPUT_CXX_COMPILER} \
113+
-DCMAKE_CXX_COMPILER="${_AIS_INPUT_CXX_COMPILER}" \
114114
-DCMAKE_CXX_FLAGS="-Werror" \
115115
-DCMAKE_HIP_PLATFORM=amd \
116116
-DAIS_BUILD_DOCS=ON \
@@ -122,7 +122,7 @@ jobs:
122122
docker exec \
123123
-t \
124124
-w /ais/hipFile/build \
125-
${AIS_CONTAINER_NAME} \
125+
"${AIS_CONTAINER_NAME}" \
126126
/bin/bash -c '
127127
cmake --build . --parallel
128128
'
@@ -131,7 +131,7 @@ jobs:
131131
docker exec \
132132
-t \
133133
-w /ais/hipFile/build \
134-
${AIS_CONTAINER_NAME} \
134+
"${AIS_CONTAINER_NAME}" \
135135
/bin/bash -c '
136136
ctest -V -L "unit" --parallel
137137
'
@@ -141,7 +141,7 @@ jobs:
141141
docker exec \
142142
-t \
143143
-w /ais/hipFile/build \
144-
${AIS_CONTAINER_NAME} \
144+
"${AIS_CONTAINER_NAME}" \
145145
/bin/bash -c '
146146
export PATH="/opt/rocm/llvm/bin:${PATH}"
147147
../util/llvm-coverage.sh
@@ -156,9 +156,9 @@ jobs:
156156
-e "_AIS_PKG_TYPE=${AIS_PKG_TYPE}" \
157157
-t \
158158
-w /ais/hipFile/build \
159-
${AIS_CONTAINER_NAME} \
159+
"${AIS_CONTAINER_NAME}" \
160160
/bin/bash -c '
161-
cpack -G ${_AIS_PKG_TYPE}
161+
cpack -G "${_AIS_PKG_TYPE}"
162162
'
163163
# CI is unable to peer into CMake to capture this data ahead of time.
164164
# We should only produce a single package so we can use a glob pattern
@@ -172,7 +172,7 @@ jobs:
172172
-e "AIS_GITHUB_OUTPUT=${{ env.AIS_GHA_CMD_FILES_DOCKER_DIR }}/${GITHUB_OUTPUT##*/}" \
173173
-t \
174174
-w /ais/hipFile/build \
175-
${AIS_CONTAINER_NAME} \
175+
"${AIS_CONTAINER_NAME}" \
176176
/bin/bash -c '
177177
shopt -s nullglob
178178
AIS_HIPFILE_PKG_DEV_FILENAME="$(echo hipfile-de{v,vel}{-,_}[0-9]*.{deb,rpm})"
@@ -182,8 +182,8 @@ jobs:
182182
echo "AIS_HIPFILE_PKG_VERSION=$(
183183
${{
184184
env.AIS_PKG_TYPE == 'DEB' &&
185-
'dpkg-deb -f ${AIS_HIPFILE_PKG_FILENAME} "Version"' ||
186-
'rpm -qp --qf "%{VERSION}" ${AIS_HIPFILE_PKG_FILENAME}'
185+
'dpkg-deb -f "${AIS_HIPFILE_PKG_FILENAME}" "Version"' ||
186+
'rpm -qp --qf "%{VERSION}" "${AIS_HIPFILE_PKG_FILENAME}"'
187187
}}
188188
)" >> "${AIS_GITHUB_OUTPUT}"
189189
'
@@ -193,23 +193,23 @@ jobs:
193193
docker exec \
194194
-t \
195195
-w /ais/hipFile/build \
196-
${AIS_CONTAINER_NAME} \
196+
"${AIS_CONTAINER_NAME}" \
197197
/bin/bash -c '
198198
echo "Runtime Package:"
199199
${{
200200
format(
201201
env.AIS_PKG_TYPE == 'DEB' &&
202-
'dpkg-deb -I {0} && dpkg-deb -c {0}' ||
203-
'rpm -qpil --requires {0}',
202+
'dpkg-deb -I "{0}" && dpkg-deb -c "{0}"' ||
203+
'rpm -qpil --requires "{0}"',
204204
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_FILENAME
205205
)
206206
}}
207207
echo -e "\n\nDevelopment Package:"
208208
${{
209209
format(
210210
env.AIS_PKG_TYPE == 'DEB' &&
211-
'dpkg-deb -I {0} && dpkg-deb -c {0}' ||
212-
'rpm -qpil --requires {0}',
211+
'dpkg-deb -I "{0}" && dpkg-deb -c "{0}"' ||
212+
'rpm -qpil --requires "{0}"',
213213
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_DEV_FILENAME
214214
)
215215
}}
@@ -225,13 +225,13 @@ jobs:
225225
docker exec \
226226
-t \
227227
-w /ais/hipFile/build \
228-
${AIS_CONTAINER_NAME} \
228+
"${AIS_CONTAINER_NAME}" \
229229
/bin/bash -c '
230230
${{
231231
format(
232-
env.AIS_PKG_MGR == 'apt' && 'apt install -y ./{0} ./{1}' ||
233-
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y ./{0} ./{1}' ||
234-
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm ./{0} ./{1}' ||
232+
env.AIS_PKG_MGR == 'apt' && 'apt install -y "./{0}" "./{1}"' ||
233+
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y "./{0}" "./{1}"' ||
234+
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm "./{0}" "./{1}"' ||
235235
'echo "Unknown platform."; exit 1',
236236
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_DEV_FILENAME,
237237
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_FILENAME
@@ -288,11 +288,11 @@ jobs:
288288
docker exec \
289289
-t \
290290
-w /ais/hipFile \
291-
${AIS_CONTAINER_NAME} \
291+
"${AIS_CONTAINER_NAME}" \
292292
/bin/bash -c '
293293
rm -rf build/*
294294
'
295295
- name: Cleanup & Stop the Docker container
296296
if: ${{ always() }}
297297
run: |
298-
docker stop ${AIS_CONTAINER_NAME}
298+
docker stop "${AIS_CONTAINER_NAME}"

‎.github/workflows/test-ais-system.yml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -82,17 +82,17 @@ jobs:
8282
--security-opt seccomp=unconfined \
8383
--pull always \
8484
-v ${GITHUB_WORKSPACE}:/mnt/ais:ro \
85-
-v ${AIS_MOUNT_PATH}:/mnt/ais-fs \
86-
--name ${AIS_CONTAINER_NAME} \
87-
${AIS_INPUT_CI_IMAGE}
85+
-v "${AIS_MOUNT_PATH}:/mnt/ais-fs" \
86+
--name "${AIS_CONTAINER_NAME}" \
87+
"${AIS_INPUT_CI_IMAGE}"
8888
- name: Create hipfile IO test directory
8989
run: |
90-
docker exec -t ${AIS_CONTAINER_NAME} /bin/bash -c "mkdir -p /mnt/ais-fs/${AIS_CONTAINER_NAME}"
90+
docker exec -t "${AIS_CONTAINER_NAME}" /bin/bash -c "mkdir -p /mnt/ais-fs/${AIS_CONTAINER_NAME}"
9191
- name: Make copy of the code repository and create build directories
9292
run: |
9393
docker exec \
9494
-t \
95-
${AIS_CONTAINER_NAME} \
95+
"${AIS_CONTAINER_NAME}" \
9696
/bin/bash -c '
9797
cp -R /mnt/ais /ais
9898
mkdir /ais/hipFile/build
@@ -101,23 +101,23 @@ jobs:
101101
- name: Copy the hipFile packages into the container
102102
run: |
103103
docker cp \
104-
${GITHUB_WORKSPACE}/${AIS_INPUT_HIPFILE_PKG_FILENAME} \
104+
"${GITHUB_WORKSPACE}/${AIS_INPUT_HIPFILE_PKG_FILENAME}" \
105105
"${AIS_CONTAINER_NAME}:/root"
106106
docker cp \
107-
${GITHUB_WORKSPACE}/${AIS_INPUT_HIPFILE_PKG_DEV_FILENAME} \
107+
"${GITHUB_WORKSPACE}/${AIS_INPUT_HIPFILE_PKG_DEV_FILENAME}" \
108108
"${AIS_CONTAINER_NAME}:/root"
109109
- name: Install the hipFile packages
110110
run: |
111111
docker exec \
112112
-t \
113113
-w /root \
114-
${AIS_CONTAINER_NAME} \
114+
"${AIS_CONTAINER_NAME}" \
115115
/bin/bash -c '
116116
${{
117117
format(
118-
env.AIS_PKG_MGR == 'apt' && 'apt install -y ./{0} ./{1}' ||
119-
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y ./{0} ./{1}' ||
120-
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm ./{0} ./{1}' ||
118+
env.AIS_PKG_MGR == 'apt' && 'apt install -y "./{0}" "./{1}"' ||
119+
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y "./{0}" "./{1}"' ||
120+
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm "./{0}" "./{1}"' ||
121121
'echo "Unknown platform."; exit 1',
122122
inputs.ais_hipfile_pkg_filename,
123123
inputs.ais_hipfile_pkg_dev_filename
@@ -142,7 +142,7 @@ jobs:
142142
docker exec \
143143
-t \
144144
-w /ais/hipFile/build \
145-
${AIS_CONTAINER_NAME} \
145+
"${AIS_CONTAINER_NAME}" \
146146
/bin/bash -c '
147147
ctest -V -L "system" --parallel
148148
'
@@ -151,16 +151,16 @@ jobs:
151151
docker exec \
152152
-t \
153153
-w /ais/hipFile/build \
154-
${AIS_CONTAINER_NAME} \
154+
"${AIS_CONTAINER_NAME}" \
155155
/bin/bash -c '
156156
ctest -V -L "stress" --parallel
157157
'
158158
- name: hipFile fallback/POSIX IO test using aiscp
159159
run: |
160160
docker exec \
161161
-t \
162-
-w /mnt/ais-fs/${AIS_CONTAINER_NAME} \
163-
${AIS_CONTAINER_NAME} \
162+
-w "/mnt/ais-fs/${AIS_CONTAINER_NAME}" \
163+
"${AIS_CONTAINER_NAME}" \
164164
/bin/bash -c '
165165
HIPFILE_FORCE_COMPAT_MODE=true
166166
/ais/hipFile/util/ci-aiscp-test.sh \
@@ -171,7 +171,7 @@ jobs:
171171
docker exec \
172172
-t \
173173
-w /ais/fio/build \
174-
${AIS_CONTAINER_NAME} \
174+
"${AIS_CONTAINER_NAME}" \
175175
/bin/bash -c '
176176
ROCM=/opt/rocm \
177177
HIPFILE=/ais/hipFile \
@@ -186,7 +186,7 @@ jobs:
186186
docker exec \
187187
-t \
188188
-w /ais/fio/build \
189-
${AIS_CONTAINER_NAME} \
189+
"${AIS_CONTAINER_NAME}" \
190190
/bin/bash -c '
191191
make -j
192192
'
@@ -195,7 +195,7 @@ jobs:
195195
docker exec \
196196
-t \
197197
-w /mnt/ais-fs/${AIS_CONTAINER_NAME} \
198-
${AIS_CONTAINER_NAME} \
198+
"${AIS_CONTAINER_NAME}" \
199199
/bin/bash -c '
200200
HIPFILE_FORCE_COMPAT_MODE=true \
201201
/ais/fio/build/fio \
@@ -204,11 +204,11 @@ jobs:
204204
- name: Destroy hipfile IO test directory
205205
if: ${{ always() }}
206206
run: |
207-
docker exec -t ${AIS_CONTAINER_NAME} /bin/bash -c "rm -fr /mnt/ais-fs/${AIS_CONTAINER_NAME}"
207+
docker exec -t "${AIS_CONTAINER_NAME}" /bin/bash -c "rm -fr /mnt/ais-fs/${AIS_CONTAINER_NAME}"
208208
- name: Cleanup & Stop the Docker container
209209
if: ${{ always() }}
210210
run: |
211-
docker stop ${AIS_CONTAINER_NAME}
211+
docker stop "${AIS_CONTAINER_NAME}"
212212
- name: Cleanup self-hosted runner workspace
213213
if: ${{ always() }}
214214
run: rm -rf ${GITHUB_WORKSPACE}/* ${GITHUB_WORKSPACE}/.*

‎.github/workflows/update-ais-ci-image.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,11 +72,11 @@ jobs:
7272
- name: Build & Push latest image for AIS CI
7373
run: |
7474
docker buildx build \
75-
-f ${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${AIS_CI_IMAGE_NAME} \
75+
-f "${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${AIS_CI_IMAGE_NAME}" \
7676
--label "org.opencontainers.image.description= \
7777
Latest AIS CI Image for ${AIS_INPUT_PLATFORM}." \
7878
--cache-to=type=registry,ref="${{ steps.ci-image.outputs.AIS_CI_IMAGE }}-cache" \
7979
${{ steps.use-cache.outputs.CACHE_FROM_CMD }} \
8080
--push \
81-
-t ${{ steps.ci-image.outputs.AIS_CI_IMAGE }} \
81+
-t "${{ steps.ci-image.outputs.AIS_CI_IMAGE }}" \
8282
${GITHUB_WORKSPACE}

0 commit comments

Comments
 (0)