fix(codeSign) esrp shell command built from environment values

[odaysec]

headlamp/app/scripts/esrp.js

Line 9 in ff50a9e

const { execSync } = require('child_process');

headlamp/app/scripts/esrp.js

Line 221 in ff50a9e

execSync(`${esrpTool} Sign -l Verbose -a ${authJson} -p ${policyJson} -i ${signInputJson}`);

Fix the issue the dynamically constructed shell command should be replaced with a safer approach that avoids shell interpretation. Specifically, the execSync call should be replaced with execFileSync, which allows passing arguments as an array. This ensures that special characters in the input are treated as literal values and do not alter the command's behavior.

implement the fix:

1. Replace the execSync call on line 221 with execFileSync.
2. Pass the command (Sign) and its arguments (-l Verbose, -a, authJson, -p, policyJson, -i, signInputJson) as separate elements in an array.
3. Ensure that all paths (authJson, policyJson, signInputJson) are validated or sanitized before use.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: odaysec
Once this PR has been reviewed and has the lgtm label, please assign sniok for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment