fix(codeSign) esrp shell command built from environment values

[odaysec]

headlamp/app/scripts/esrp.js

Line 9 in ff50a9e

const { execSync } = require('child_process');

headlamp/app/scripts/esrp.js

Line 221 in ff50a9e

execSync(`${esrpTool} Sign -l Verbose -a ${authJson} -p ${policyJson} -i ${signInputJson}`);

Fix the issue the dynamically constructed shell command should be replaced with a safer approach that avoids shell interpretation. Specifically, the execSync call should be replaced with execFileSync, which allows passing arguments as an array. This ensures that special characters in the input are treated as literal values and do not alter the command's behavior.

implement the fix:

1. Replace the execSync call on line 221 with execFileSync.
2. Pass the command (Sign) and its arguments (-l Verbose, -a, authJson, -p, policyJson, -i, signInputJson) as separate elements in an array.
3. Ensure that all paths (authJson, policyJson, signInputJson) are validated or sanitized before use.

[skoeva]

Hi, thanks for looking into this! Be sure to fix any frontend linting errors with make frontend-fixlint.

It would be also nice if you could tweak the commit & PR titles to match our commit guidelines.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joaquimrocha, odaysec

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [joaquimrocha]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[joaquimrocha]

Ah, yeah, we need the linter complaint to be fixed. You should run make frontend-fixlint, @odaysec .