feat: orchestrion pin can track enabled integrations
#376
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
| } | ||
|
|
||
| func runGoMod(command string, modfile string, stdout io.Writer, args ...string) error { | ||
| cmd := exec.Command("go", "mod", command, "-modfile", modfile) |
There was a problem hiding this comment.
🟠 Code Vulnerability
Check command call and ensure there is no unsanitized data used. The variable `command` may need to be validated (...read more)
In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities.
Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.
To prevent command injection vulnerabilities when using exec.Command in Go, follow these coding best practices:
- Sanitize User Input: Always validate and sanitize user inputs before passing them to
exec.Command. Avoid executing commands constructed using user-provided data. - Avoid using Shell Expansion: If possible, pass the command and arguments as separate strings to
exec.Command. This prevents the shell from interpreting special characters in a potentially malicious way. - Use Absolute Paths: When specifying the command to be executed, use absolute paths for executables whenever possible. This reduces the risk of inadvertently running a similarly named malicious command from the system's PATH.
- Avoid String Concatenation: Refrain from dynamically constructing commands by concatenating strings. Instead, use the
arg ...stringparameter ofexec.Commandto pass arguments safely. - Limit Privileges: Run commands with the least privilege required to carry out the task. Avoid running commands with elevated privileges unnecessarily.
By following these practices, you can reduce the risk of command injection vulnerabilities when using exec.Command in Go and enhance the security of your application.
…EC-55160/enhance-pin # Conflicts: # samples/go.mod # samples/go.sum
eliottness
reviewed
Nov 5, 2024
…EC-55160/enhance-pin # Conflicts: # internal/pin/pin.go
RomainMuller
force-pushed
the
romain.marcadier/APPSEC-55160/enhance-pin
branch
from
7ed5c27 to
058d70a
Compare
Signed-off-by: Eliott Bouhana <[email protected]>
This was referenced Nov 7, 2024
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
eliottness
approved these changes
Nov 7, 2024
Comment on lines
+58
to
+66
| &cli.StringFlag{ | ||
| Category: "Advanced", | ||
| Name: "C", | ||
| Usage: "Change to the specified directory before proceeding with the rest of the command.", | ||
| Hidden: true, // Users don't normally need to use this. | ||
| Action: func(_ *cli.Context, dir string) error { | ||
| return os.Chdir(dir) | ||
| }, | ||
| }, |
There was a problem hiding this comment.
I'm not sure that bug still reproduces today (before this change).
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #376 +/- ##
==========================================
+ Coverage 60.28% 60.81% +0.52%
==========================================
Files 166 174 +8
Lines 11973 12302 +329
==========================================
+ Hits 7218 7481 +263
- Misses 4280 4340 +60
- Partials 475 481 +6
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Initial changes to how
orchestrion pinworks to support incremental edits to the file. This is in preparation to moving the aspects/integration definitions from orchestrion itself to the tracer library.