diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-27 18:25:23 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-27 18:25:23 +0900 |
| commit | 605d018be266a9e0d5c8256d647e3a61fa6df79a (patch) | |
| tree | 30563bd44e70153c8d362675fea36459428e5dc0 /internal | |
| parent | 78aaae7ee0e156239e6bb90d28c43bf51ab24da2 (diff) | |
app/seal: check for '=' in envv
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/seal.go | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index 9d338780..69284239 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -8,7 +8,6 @@ import ( "fmt" "io" "io/fs" - "maps" "os" "path" "regexp" @@ -505,7 +504,13 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co // flatten and sort env for deterministic behaviour seal.container.Env = make([]string, 0, len(seal.env)) - maps.All(seal.env)(func(k string, v string) bool { seal.container.Env = append(seal.container.Env, k+"="+v); return true }) + for k, v := range seal.env { + if strings.IndexByte(k, '=') != -1 { + return fmsg.WrapError(syscall.EINVAL, + fmt.Sprintf("invalid environment variable %s", k)) + } + seal.container.Env = append(seal.container.Env, k+"="+v) + } slices.Sort(seal.container.Env) fmsg.Verbosef("created application seal for uid %s (%s) groups: %v, argv: %s", |