admin/andreicscs-HoneyWire
1
0
Fork 0
mirror of https://github.com/andreicscs/HoneyWire synced 2026-06-26 12:39:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed security issue in sensor rolback workflow and removed false positive from appli.go

Browse Source
This commit is contained in:
AndReicscs
2026-06-16 09:20:07 +00:00
parent 46b8366b74
commit 0da85df026
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/rollback-sensor-registry.yml
+6 -2
View File
@@ -32,8 +32,10 @@ jobs:
- name: Perform Rollback
id: rollback
env:
SENSOR_NAME: ${{ inputs.sensor_name }}
run: |
SENSOR_TARGET="${{ inputs.sensor_name }}"
SENSOR_TARGET="$SENSOR_NAME"
if [ ! -f index.json ]; then
echo "❌ index.json not found in registry-pages branch!"
@@ -87,9 +89,11 @@ jobs:
- name: Commit and push changes
if: steps.rollback.outputs.count > 0
env:
SENSOR_NAME: ${{ inputs.sensor_name }}
run: |
git add *.json
git commit -m "registry: rollback ${{ inputs.sensor_name }}
git commit -m "registry: rollback $SENSOR_NAME
Automated rollback of the latest versions via deprecation."
wizard/internal/deploy/apply.go
+8
View File
@@ -25,6 +25,8 @@ func performRollback(reason string, hasBackup bool, backupPath, composePath stri
defer rollbackCancel()
rollbackArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "up", "-d", "--remove-orphans")
// codeql[go/command-injection]
// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
rollbackCmd := exec.CommandContext(rollbackCtx, rollbackArgs[0], rollbackArgs[1:]...)
rollbackCmd.Dir = DeployDir
rollbackCmd.Stdout = os.Stdout
@@ -85,6 +87,8 @@ func Apply(ctx context.Context, composeData []byte) error {
defer pullCancel()
pullArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "pull")
// codeql[go/command-injection]
// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
pullCmd := exec.CommandContext(pullCtx, pullArgs[0], pullArgs[1:]...)
pullCmd.Dir = DeployDir
pullCmd.Stdout = os.Stdout
@@ -98,6 +102,8 @@ func Apply(ctx context.Context, composeData []byte) error {
defer upCancel()
upArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "up", "-d", "--remove-orphans")
// codeql[go/command-injection]
// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
upCmd := exec.CommandContext(upCtx, upArgs[0], upArgs[1:]...)
upCmd.Dir = DeployDir
upCmd.Stdout = os.Stdout
@@ -114,6 +120,8 @@ func Apply(ctx context.Context, composeData []byte) error {
defer checkCancel()
checkArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "ps", "--services", "--filter", "status=exited", "--filter", "status=restarting")
// codeql[go/command-injection]
// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
checkCmd := exec.CommandContext(checkCtx, checkArgs[0], checkArgs[1:]...)
checkCmd.Dir = DeployDir