[AI-6752] Sanitize guarddog_path argument (#23377)

* Fix guarddog_path argument injection in command execution

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

* remove whitespace check and add changelog

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

* fix style

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

* remove unused constant

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

* Update guarddog/changelog.d/23377.fixed

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

---------

Signed-off-by: sarah-witt <sarah.witt@datadoghq.com>

Author: sarah-witt

guarddog/changelog.d/23377.fixed

@@ -0,0 +1 @@
+Sanitize guarddog_path argument

guarddog/datadog_checks/guarddog/check.py

@@ -8,8 +8,6 @@
 from datadog_checks.base import AgentCheck, ConfigurationError
 from datadog_checks.base.utils.time import get_current_datetime, get_timestamp
 
-from . import constants
-
 
 class GuarddogCheck(AgentCheck):
     __NAMESPACE__ = "guarddog"
@@ -27,10 +25,10 @@ def __init__(self, name, init_config, instances):
         self.guarddog_path = str(init_config.get('guarddog_path')).strip()
         self.check_initializations.append(self.validate_config)
 
-    def get_guarddog_output(self, cmd_with_abs_path) -> subprocess.CompletedProcess:
+    def get_guarddog_output(self, command_parts) -> subprocess.CompletedProcess:
         try:
-            self.log.debug("Running command: %s", cmd_with_abs_path)
-            cmd_output_with_abs_path = subprocess.run(cmd_with_abs_path.split(), capture_output=True, text=True)
+            self.log.debug("Running command: %s", command_parts)
+            cmd_output_with_abs_path = subprocess.run(command_parts, capture_output=True, text=True)
             return cmd_output_with_abs_path
         except FileNotFoundError as cmd_error:
             err_message = "GuardDog is not found at configured path."
@@ -70,11 +68,9 @@ def validate_config(self) -> None:
     def check(self, _):
         try:
             current_time = get_current_datetime()
-            guarddog_command = constants.GUARDDOG_COMMAND.format(
-                package_ecosystem=self.package_ecosystem,
-                path=self.path,
+            cmd_result = self.get_guarddog_output(
+                [self.guarddog_path, self.package_ecosystem, "verify", self.path, "--output-format=json"]
             )
-            cmd_result = self.get_guarddog_output(self.guarddog_path + " " + guarddog_command)
             if cmd_result.returncode != 0:
                 cmd_result_err_message = f"GuardDog command failed: {cmd_result.stderr}"
                 self.log.error(cmd_result_err_message)

guarddog/datadog_checks/guarddog/constants.py

@@ -3,4 +3,3 @@
 # Licensed under a 3-clause BSD style license (see LICENSE)
 VALID_ECOSYSTEMS = ["pypi", "npm", "go", "github_action"]
 DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
-GUARDDOG_COMMAND = "{package_ecosystem} verify {path} --output-format=json"

guarddog/tests/test_unit.py

@@ -166,7 +166,7 @@ def test_get_guarddog_output(config, instance, mocker):
     expected_returncode = 0
     check.package_ecosystem = "pypi"
     check.path = dependency_file_path
-    cmd = "guarddog pypi verify /tmp/dependency_file_path/requirements.txt --output-format=json"
+    cmd = ["guarddog", "pypi", "verify", "/tmp/dependency_file_path/requirements.txt", "--output-format=json"]
 
     mock_completed_process = Mock(stdout=expected_stdout, stderr=expected_stderr, returncode=expected_returncode)