Skip to content

hack: unquoted ${YAML_OUTPUT_DIR} in rm command is a word-splitting risk #8989

@Ankitsinghsisodya

Description

@Ankitsinghsisodya

Problem

In hack/generate-yamls.sh line 48, ${YAML_OUTPUT_DIR} is used unquoted in the rm -fr command:

rm -fr ${YAML_OUTPUT_DIR}/*.yaml

If the path stored in YAML_OUTPUT_DIR contains spaces or special characters, the shell performs word-splitting and glob-expansion on the unquoted variable, which can cause the command to delete files in the wrong locations or fail silently.

Proposed Fix

rm -fr "${YAML_OUTPUT_DIR}"/*.yaml

This is consistent with how the variable is used elsewhere in the same script (e.g. "${EVENTING_CORE_YAML}").

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

Status

Backlog

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions