Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 4 additions & 20 deletions .github/workflows/validate-plugins.yml
Original file line number Diff line number Diff line change
Expand Up @@ -79,16 +79,8 @@ jobs:
run: |
set -o pipefail
echo "Validating changed plugins: $CHANGED_PLUGINS"
echo "DEBUG: Length of CHANGED_PLUGINS: ${#CHANGED_PLUGINS}"
echo "DEBUG: CHANGED_PLUGINS (hex): $(echo -n "$CHANGED_PLUGINS" | od -A n -t x1)"
if [[ -n "$CHANGED_PLUGINS" ]]; then
IFS=' ' read -r -a PLUGINS_ARRAY <<< "$CHANGED_PLUGINS"
echo "DEBUG: Array length: ${#PLUGINS_ARRAY[@]}"
echo "DEBUG: Array contents: ${PLUGINS_ARRAY[@]}"
./scripts/validate-plugin-structure.sh "${PLUGINS_ARRAY[@]}" 2>&1 | tee /tmp/structure-validation.log
else
echo "DEBUG: CHANGED_PLUGINS is empty, skipping validation"
fi
read -ra PLUGINS_ARRAY <<< "$CHANGED_PLUGINS"
./scripts/validate-plugin-structure.sh "${PLUGINS_ARRAY[@]}" 2>&1 | tee /tmp/structure-validation.log

- name: Validate marketplace.json
id: marketplace
Expand All @@ -99,16 +91,8 @@ jobs:
run: |
set -o pipefail
echo "Validating marketplace entries for changed plugins: $CHANGED_PLUGINS"
echo "DEBUG: Length of CHANGED_PLUGINS: ${#CHANGED_PLUGINS}"
echo "DEBUG: CHANGED_PLUGINS (hex): $(echo -n "$CHANGED_PLUGINS" | od -A n -t x1)"
if [[ -n "$CHANGED_PLUGINS" ]]; then
IFS=' ' read -r -a PLUGINS_ARRAY <<< "$CHANGED_PLUGINS"
echo "DEBUG: Array length: ${#PLUGINS_ARRAY[@]}"
echo "DEBUG: Array contents: ${PLUGINS_ARRAY[@]}"
./scripts/validate-marketplace.sh "${PLUGINS_ARRAY[@]}" 2>&1 | tee /tmp/marketplace-validation.log
else
echo "DEBUG: CHANGED_PLUGINS is empty, skipping validation"
fi
read -ra PLUGINS_ARRAY <<< "$CHANGED_PLUGINS"
./scripts/validate-marketplace.sh "${PLUGINS_ARRAY[@]}" 2>&1 | tee /tmp/marketplace-validation.log

- name: Log in to Azure
if: steps.changed-files.outputs.has_components == 'true'
Expand Down
12 changes: 9 additions & 3 deletions scripts/lib/path-sanitization.sh
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,15 @@ sanitize_plugin_path() {
local arg="$1"
local plugins_dir="$2"

# Reject paths containing null bytes, newlines, or carriage returns
if [[ "$arg" =~ $'\0' ]] || [[ "$arg" =~ $'\n' ]] || [[ "$arg" =~ $'\r' ]]; then
echo "ERROR: Path contains invalid characters (null/newline/carriage return)" >&2
# Reject paths containing newlines or carriage returns
# Note: Null bytes can't exist in bash strings (they terminate strings),
# so we only need to check for newline and carriage return
if [[ "$arg" == *$'\n'* ]]; then
echo "ERROR: Path contains newline" >&2
return 1
fi
if [[ "$arg" == *$'\r'* ]]; then
echo "ERROR: Path contains carriage return" >&2
return 1
fi

Expand Down
8 changes: 1 addition & 7 deletions scripts/validate-marketplace.sh
Original file line number Diff line number Diff line change
Expand Up @@ -284,21 +284,15 @@ main() {
# Build list of plugins to validate
local target_plugins=()
if [[ $# -gt 0 ]]; then
echo "DEBUG: Received $# argument(s): $*"
# Arguments provided - extract plugin names
for arg in "$@"; do
echo "DEBUG: Processing argument: '$arg'"
# Use shared sanitization function to safely parse plugin path
local sanitized_path
if sanitized_path=$(sanitize_plugin_path "$arg" "$REPO_ROOT/plugins" 2>&1); then
if sanitized_path=$(sanitize_plugin_path "$arg" "$REPO_ROOT/plugins" 2>/dev/null); then
# Extract just the plugin name from the full path
local plugin_name
plugin_name=$(basename "$sanitized_path")
echo "DEBUG: โœ“ Sanitized to: '$sanitized_path' โ†’ plugin name: '$plugin_name'"
target_plugins+=("$plugin_name")
else
echo "DEBUG: โœ— Failed to sanitize argument '$arg'"
echo "DEBUG: Output from sanitize_plugin_path: $sanitized_path"
fi
done

Expand Down
8 changes: 1 addition & 7 deletions scripts/validate-plugin-structure.sh
Original file line number Diff line number Diff line change
Expand Up @@ -369,17 +369,11 @@ main() {

# If arguments provided, validate only those plugins
if [[ $# -gt 0 ]]; then
echo "DEBUG: Received $# argument(s): $*"
for arg in "$@"; do
echo "DEBUG: Processing argument: '$arg'"
# Use shared sanitization function to safely parse plugin path
local sanitized_path
if sanitized_path=$(sanitize_plugin_path "$arg" "$PLUGINS_DIR" 2>&1); then
echo "DEBUG: โœ“ Sanitized to: '$sanitized_path'"
if sanitized_path=$(sanitize_plugin_path "$arg" "$PLUGINS_DIR" 2>/dev/null); then
plugins+=("$sanitized_path")
else
echo "DEBUG: โœ— Failed to sanitize argument '$arg'"
echo "DEBUG: Output from sanitize_plugin_path: $sanitized_path"
fi
done

Expand Down