Skip to content

OSSM: skip TLS ADherence test to avoid failures #83115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fjglira wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OSSM: skip TLS ADherence test to avoid failures #83115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...shift-service-mesh/sail-operator/openshift-service-mesh-sail-operator-main__ocp-4.22.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ tests:
env:
COMPUTE_NODE_TYPE: r6g.xlarge
CONTROL_PLANE_INSTANCE_TYPE: r6g.xlarge
GINKGO_LABEL_FILTER: '!tls-profile'
HUB: quay.io/sail-dev
INSTALLATION_METHOD: helm
MAISTRA_BUILDER_IMAGE: registry.istio.io/testing/build-tools:master-6db0b4c7fbe345bd531a07fbcff13877dc9cd801
Expand All @@ -133,6 +134,7 @@ tests:
env:
COMPUTE_NODE_TYPE: r6g.xlarge
CONTROL_PLANE_INSTANCE_TYPE: r6g.xlarge
GINKGO_LABEL_FILTER: '!tls-profile'
HUB: quay.io/sail-dev
INSTALLATION_METHOD: helm
MAISTRA_BUILDER_IMAGE: registry.istio.io/testing/build-tools:master-6db0b4c7fbe345bd531a07fbcff13877dc9cd801
Expand Down
2 changes: 2 additions & 0 deletions ...shift-service-mesh/sail-operator/openshift-service-mesh-sail-operator-main__ocp-4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ tests:
steps:
cluster_profile: ossm-aws
env:
GINKGO_LABEL_FILTER: '!tls-profile'
HUB: quay.io/sail-dev
INSTALLATION_METHOD: helm
MAISTRA_BUILDER_IMAGE: registry.istio.io/testing/build-tools:master-63fd6eec6f3df5a3ed4e190e60153ef3425f66b4
Expand All @@ -55,6 +56,7 @@ tests:
steps:
cluster_profile: ossm-aws
env:
GINKGO_LABEL_FILTER: '!tls-profile'
HUB: quay.io/sail-dev
INSTALLATION_METHOD: helm
MAISTRA_BUILDER_IMAGE: registry.istio.io/testing/build-tools:master-63fd6eec6f3df5a3ed4e190e60153ef3425f66b4
Expand Down
1 change: 1 addition & 0 deletions ...-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,7 @@ run_tests() {
export HUB=\"${HUB:-quay.io/sail-dev}\"
export USE_INTERNAL_REGISTRY=\"false\"
export PR_NUMBER=\"${PULL_NUMBER:-}\"
export GINKGO_LABEL_FILTER=\"${GINKGO_LABEL_FILTER:-}\"

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

filter='$(printf INJECTED)'
unsafe_script="export GINKGO_LABEL_FILTER=\"${filter}\"; printf '%s' \"\$GINKGO_LABEL_FILTER\""
actual="$(sh -c "$unsafe_script")"

if [[ "$actual" == "INJECTED" ]]; then
  echo "The current interpolation executes command substitution."
else
  echo "The current interpolation did not reproduce the expected injection."
  exit 1
fi

Repository: openshift/release

Length of output: 212

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'
printf '%s\n' '--- target lines ---'
sed -n '110,165p' "$file"
printf '%s\n' '--- relevant identifiers and shell invocations ---'
rg -n -C 3 'GINKGO_LABEL_FILTER|oc rsh|QUAY_PASSWORD|docker login|sh -c' "$file"

Repository: openshift/release

Length of output: 3997

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'

printf '%s\n' '--- repository references ---'
rg -n -C 3 'GINKGO_LABEL_FILTER|VERSIONS_YAML_CONFIG|E2E_COMMAND|QUAY_PASSWORD|servicemesh-sail-operator-e2e-ocp' \
  --glob '!vendor/**' --glob '!node_modules/**' .

printf '%s\n' '--- exact nested-shell probe ---'
python3 - <<'PY'
import os
import subprocess

value = '$(printf INJECTED)'
unsafe = f'export GINKGO_LABEL_FILTER="{value}"; printf "%s" "$GINKGO_LABEL_FILTER"'
safe = 'export GINKGO_LABEL_FILTER="${GINKGO_LABEL_FILTER:-}"; printf "%s" "$GINKGO_LABEL_FILTER"'

unsafe_result = subprocess.run(
    ['sh', '-c', unsafe], text=True, capture_output=True, check=True
)
safe_env = os.environ.copy()
safe_env['GINKGO_LABEL_FILTER'] = value
safe_result = subprocess.run(
    ['sh', '-c', safe], env=safe_env, text=True, capture_output=True, check=True
)

print(f'unsafe output: {unsafe_result.stdout!r}')
print(f'safe output: {safe_result.stdout!r}')
assert unsafe_result.stdout == 'INJECTED'
assert safe_result.stdout == value
print('nested-shell probe passed')
PY

Repository: openshift/release

Length of output: 50374

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

ref='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-ref.yaml'
file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'

printf '%s\n' '--- step definition ---'
sed -n '1,55p' "$ref"

printf '%s\n' '--- direct callers ---'
rg -l 'servicemesh-sail-operator-e2e-ocp' ci-operator/config ci-operator/step-registry |
  head -50 |
  xargs -r rg -n -C 2 'servicemesh-sail-operator-e2e-ocp|GINKGO_LABEL_FILTER'

printf '%s\n' '--- exact nested-shell probe ---'
python3 - <<'PY'
import os
import subprocess

value = '$(printf INJECTED)'
unsafe = f'export GINKGO_LABEL_FILTER="{value}"; printf "%s" "$GINKGO_LABEL_FILTER"'
safe = 'export GINKGO_LABEL_FILTER="${GINKGO_LABEL_FILTER:-}"; printf "%s" "$GINKGO_LABEL_FILTER"'

unsafe_result = subprocess.run(
    ['sh', '-c', unsafe], text=True, capture_output=True, check=True
)
safe_env = os.environ.copy()
safe_env['GINKGO_LABEL_FILTER'] = value
safe_result = subprocess.run(
    ['sh', '-c', safe], env=safe_env, text=True, capture_output=True, check=True
)

print(f'unsafe output: {unsafe_result.stdout!r}')
print(f'safe output: {safe_result.stdout!r}')
assert unsafe_result.stdout == 'INJECTED'
assert safe_result.stdout == value
print('nested-shell probe passed')
PY

Repository: openshift/release

Length of output: 27028

Pass GINKGO_LABEL_FILTER as data, not shell code.

GINKGO_LABEL_FILTER is interpolated into the script passed to remote sh -c. Values containing $(...), backticks, ;, or " can execute commands or alter the script. The commands run in the test pod, which has logged in to Quay and set KUBECONFIG.

Pass the value through env or a positional parameter, then escape the remote expansion.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh`
at line 139, Update the remote command construction around GINKGO_LABEL_FILTER
so its value is passed as data through env or a positional parameter rather than
interpolated into the sh -c script. Escape the remote expansion and preserve the
existing empty-default behavior, preventing shell metacharacters such as command
substitutions, semicolons, backticks, and quotes from altering execution.

Source: Coding guidelines

${VERSIONS_YAML_CONFIG:-}
oc version
cd /work
Expand Down
4 changes: 4 additions & 0 deletions ...tep-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-ref.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,9 @@ ref:
default: "quay.io/sail-dev"
documentation: |-
Container registry hub to use for pushing images when CI=true
- name: GINKGO_LABEL_FILTER
default: ""
documentation: |-
Optional Ginkgo label filter expression to select/skip tests (e.g. "!tls-profile")
documentation: |-
Executes sail operator e2e tests (with default values against product operator (ossm operator)). Ensure that your pipeline has `maistra-builder` as the build root, since `from: src` is used here and the script expects the sail repository to be in the root directory.