fix(build_config): validate envs[*].name against POSIX env-var regex#5614
Open
ibondarenko1 wants to merge 1 commit into
Open
fix(build_config): validate envs[*].name against POSIX env-var regex#5614ibondarenko1 wants to merge 1 commit into
ibondarenko1 wants to merge 1 commit into
Conversation
CVE-2026-44346 (GHSA-w2pm-x38x-jp44) fixed Dockerfile command injection via envs[*].name by shell-quoting at template render time. The field is still accepted as an arbitrary string at parse time; the protection relies entirely on downstream Dockerfile escape. POSIX env-var names match ^[A-Za-z_][A-Za-z0-9_]*$ (IEEE Std 1003.1 section 3.231). Catching malformed names at parse time produces a clear bentofile error and is a layered defense. Add an attr validator on BentoEnvSchema.name that requires the POSIX regex. Reject malformed names with a clear ValueError at parse.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CVE-2026-44346 (GHSA-w2pm-x38x-jp44) fixed Dockerfile command injection via
envs[*].nameby shell-quoting at template render time. The field is still accepted as an arbitrary string at parse time; the protection relies entirely on downstream Dockerfile escape.POSIX env-var names match
^[A-Za-z_][A-Za-z0-9_]*$(IEEE Std 1003.1, section 3.231). Catching malformed names at parse time produces a clear bentofile error and is a layered defense if any future template path accidentally bypasses escape.What
Add an
attr.fieldvalidator onBentoEnvSchema.namethat requires the POSIX regex. Reject malformed names with a clearValueErrorat parse.Impact
Testing
pytest tests/unit/_internal/bento/test_build_config.py(existing test suite).Add a regression test asserting
BentoEnvSchema(name="FOO-BAR")raises if maintainer requests.