Skip to content

Harden find_replace.sh CI helper against argument splitting - #1490

Open
wbemont wants to merge 1 commit into
FreeRTOS:mainfrom
wbemont:ci/harden-find_replace-arg-injection
Open

wbemont wants to merge 1 commit into
FreeRTOS:mainfrom
wbemont:ci/harden-find_replace-arg-injection

Conversation

@wbemont

@wbemont wbemont commented Sep 9, 2026

Copy link
Copy Markdown

Description

.github/scripts/find_replace.sh piped grep -rl output into xargs gsed
using xargs' default whitespace splitting and quote processing, and passed the
search pattern to grep/gsed without terminating option parsing. Paths
containing spaces, quotes, or values beginning with - could be split into
multiple arguments or interpreted as options rather than data.

This change uses NUL-delimited matching (grep -rlZ | xargs -0) so filenames
are passed verbatim, and adds -- after grep's options to end option parsing.
Behavior is otherwise unchanged. This is a CI helper-script hardening / hygiene
improvement.

Test Steps

In a scratch directory with two files containing the search text — one whose
name contains a space — ran find_replace.sh FOO BAR:

  • both files had FOO replaced with BAR
  • the filename with a space was handled correctly (the previous unquoted
    xargs split it into non-existent paths)

bash -n reports no syntax errors.

Checklist:

  • I have tested my changes. No regression in existing tests.
  • I have modified and/or added unit-tests to cover the code changes in this Pull Request.

Related Issue

N/A

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

The find/replace helper piped `grep -rl` output into `xargs gsed` using
xargs' default whitespace splitting and quote processing, and passed the
search pattern to grep/gsed without terminating option parsing. Paths
containing spaces (or values beginning with `-`) could be split into
multiple arguments or interpreted as options rather than data.

Use NUL-delimited matching (`grep -rlZ | xargs -0`) so filenames are
passed verbatim, and add `--` after grep's options to end option parsing.
Behavior is otherwise unchanged.
@sonarqubecloud

sonarqubecloud Bot commented Sep 9, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant