fix: pass SNAPSHOT as env var to prevent shell injection (RSPEED-3360)

[Lifto]

Summary

Fixes shell injection vulnerability in the extract-server-image task (RSPEED-3360, CWE-78, CVSS 6.4).

Problem

The SNAPSHOT pipeline parameter was interpolated directly into a bash script via Tekton variable substitution inside a heredoc. Since Tekton performs $(params.*) replacement textually before the shell runs, an attacker who can influence the SNAPSHOT value could inject a literal newline followed by EOF to terminate the heredoc early and append arbitrary shell commands.

Fix

Pass SNAPSHOT via steps[].env[].value: $(params.SNAPSHOT) and reference it as "$SNAPSHOT" inside the script, following Tekton security guidance on variable substitution.

Before:

script: |
  cat << 'EOF' | jq -r '.components[0].containerImage' ...
  $(params.SNAPSHOT)
  EOF

After:

env:
  - name: SNAPSHOT
    value: $(params.SNAPSHOT)
script: |
  echo "$SNAPSHOT" | jq -r '.components[0].containerImage' ...

Testing

This pipeline has no local test harness — it runs on Tekton in the CI cluster. The fix is a mechanical substitution (heredoc interpolation → env var), and the pipeline behavior is unchanged: SNAPSHOT JSON is still parsed by jq to extract the container image URL.

Post-merge validation: We will monitor the next CI run that triggers this pipeline and revert if the change causes failures.

Jira: RSPEED-3360

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: rhel-lightspeed/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: b758ee64-bd10-4ca6-995e-2462b4e381c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rspeed-3360-snapshot-env-var

---

_{Comment @coderabbitai help to get the list of available commands.}

[samdoran]

Duplicate of #14.