fix: use non-expandable here-string for windows script placement

The place-scripts init container's Windows path wrapped script content
in an expandable here-string (@"..."@), which PowerShell terminates on
any "@ appearing on its own line within the content. A script whose
body contains that sequence (e.g. via $(params.x) substitution) would
end the here-string early, turning the remaining content into
PowerShell commands executed in the init container.

Switched to the non-expandable form (@'...'@), matching how the Linux
path already avoids the equivalent issue with a single-quoted heredoc.
Only a '@ line on its own can now terminate the string, which is far
less likely to appear in script content.

This is defense-in-depth, not a fix for the underlying $(params.x) raw
substitution design (reported via a security advisory, closed as not a
vulnerability: same trust domain as the existing Linux script
injection class).

Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@gmail.com>

Author: ogulcanaydogan

pkg/pod/script.go

@@ -179,9 +179,9 @@ func placeScriptInContainer(script, scriptFile string, c *corev1.Container, init
 	// script file in a known location in the scripts volume.
 	if requiresWindows {
 		command, args, script, scriptFile := extractWindowsScriptComponents(script, scriptFile)
-		initContainer.Args[1] += fmt.Sprintf(`@"
+		initContainer.Args[1] += fmt.Sprintf(`@'
 %s
-"@ | Out-File -FilePath %s
+'@ | Out-File -FilePath %s
 `, script, scriptFile)
 
 		c.Command = command

pkg/pod/script_test.go

@@ -781,17 +781,17 @@ no-shebang`,
 		Name:    "place-scripts",
 		Image:   images.ShellImageWin,
 		Command: []string{"pwsh"},
-		Args: []string{"-Command", `@"
+		Args: []string{"-Command", `@'
 #!win pwsh -File
 script-1
-"@ | Out-File -FilePath /tekton/scripts/script-0-9l9zj
-@"
+'@ | Out-File -FilePath /tekton/scripts/script-0-9l9zj
+@'
 #!win powershell -File
 script-3
-"@ | Out-File -FilePath /tekton/scripts/script-2-mz4c7.ps1
-@"
+'@ | Out-File -FilePath /tekton/scripts/script-2-mz4c7.ps1
+@'
 no-shebang
-"@ | Out-File -FilePath /tekton/scripts/script-3-mssqb.cmd
+'@ | Out-File -FilePath /tekton/scripts/script-3-mssqb.cmd
 `},
 		VolumeMounts:    []corev1.VolumeMount{writeScriptsVolumeMount, binMount},
 		SecurityContext: WindowsSecurityContext,
@@ -863,18 +863,18 @@ sidecar-1`,
 		Name:    "place-scripts",
 		Image:   images.ShellImageWin,
 		Command: []string{"pwsh"},
-		Args: []string{"-Command", `@"
+		Args: []string{"-Command", `@'
 #!win pwsh -File
 script-1
-"@ | Out-File -FilePath /tekton/scripts/script-0-9l9zj
-@"
+'@ | Out-File -FilePath /tekton/scripts/script-0-9l9zj
+@'
 #!win powershell -File
 script-3
-"@ | Out-File -FilePath /tekton/scripts/script-2-mz4c7.ps1
-@"
+'@ | Out-File -FilePath /tekton/scripts/script-2-mz4c7.ps1
+@'
 #!win pwsh -File
 sidecar-1
-"@ | Out-File -FilePath /tekton/scripts/sidecar-script-0-mssqb
+'@ | Out-File -FilePath /tekton/scripts/sidecar-script-0-mssqb
 `},
 		VolumeMounts:    []corev1.VolumeMount{writeScriptsVolumeMount, binMount},
 		SecurityContext: WindowsSecurityContext,
@@ -933,10 +933,10 @@ sidecar-1`,
 		Name:    "place-scripts",
 		Image:   images.ShellImageWin,
 		Command: []string{"pwsh"},
-		Args: []string{"-Command", `@"
+		Args: []string{"-Command", `@'
 #!win python
 sidecar-1
-"@ | Out-File -FilePath /tekton/scripts/sidecar-script-0-9l9zj
+'@ | Out-File -FilePath /tekton/scripts/sidecar-script-0-9l9zj
 `},
 		VolumeMounts:    []corev1.VolumeMount{writeScriptsVolumeMount, binMount},
 		SecurityContext: WindowsSecurityContext,
@@ -965,3 +965,40 @@ sidecar-1
 		t.Errorf("Wanted 1 sidecar, got %v", len(gotSidecars))
 	}
 }
+
+// TestConvertScripts_Windows_LiteralHereStringTerminator guards against a script body that
+// contains a literal `"@` line breaking out of the generated PowerShell here-string. The
+// expandable here-string (`@"..."@`) treats `"@` on its own line as its terminator, so a
+// script containing that sequence (e.g. from `$(params.x)` substitution) would end the
+// here-string early and turn the remaining script content into PowerShell commands run in
+// the init container. Using the non-expandable form (`@'...'@`) means only a `'@` line on
+// its own can terminate it, so a literal `"@` line is passed through as inert script content.
+func TestConvertScripts_Windows_LiteralHereStringTerminator(t *testing.T) {
+	names.TestingSeed()
+
+	gotInit, _, _ := convertScripts(images.ShellImage, images.ShellImageWin, []v1.Step{{
+		Script: `#!win pwsh -File
+echo before
+"@
+echo after`,
+		Image: "step-1",
+	}}, []v1.Sidecar{}, nil, SecurityContextConfig{SetSecurityContext: true, SetReadOnlyRootFilesystem: true})
+
+	wantInit := &corev1.Container{
+		Name:    "place-scripts",
+		Image:   images.ShellImageWin,
+		Command: []string{"pwsh"},
+		Args: []string{"-Command", `@'
+#!win pwsh -File
+echo before
+"@
+echo after
+'@ | Out-File -FilePath /tekton/scripts/script-0-9l9zj
+`},
+		VolumeMounts:    []corev1.VolumeMount{writeScriptsVolumeMount, binMount},
+		SecurityContext: WindowsSecurityContext,
+	}
+	if d := cmp.Diff(wantInit, gotInit); d != "" {
+		t.Errorf("Init Container Diff %s", diff.PrintWantGot(d))
+	}
+}