fix: paramters db #474
fix: paramters db #474
Conversation
WalkthroughAdds a parameter-consistency check that sets USE_PARAMS_DB when all three DB_MAIN_* params are provided; branches DB creation and env sourcing in the pipeline to use DB_MAIN_* when enabled or fallback to TURSO_* when not; adds status echoes and keeps existing validations and URL construction. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer
participant J as Jenkins Pipeline
participant E as Env Vars
participant D as DB Provider
Dev->>J: Trigger deploy
J->>E: Read DB_MAIN_EU / DB_MAIN_US_WEST / DB_MAIN_US_EAST
J->>J: Count non-empty DB_MAIN_* params
alt all three present
J->>E: Set USE_PARAMS_DB = "true"
Note over J,E: Use DB_MAIN_* as DB sources
else
J->>E: Set USE_PARAMS_DB = "false"
Note over J,E: Use TURSO_*_DB as DB sources
end
rect rgb(235,245,255)
Note over J: Branch db stage
alt USE_PARAMS_DB == "true"
J->>D: Create branch DBs using DB_MAIN_* values
else
J->>D: Create branch DBs using TURSO_*_DB values
end
end
J->>E: Validate DBs exist, construct URLs
J-->>Dev: Echo status and proceed
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
PR is detected, will deploy to dev environment |
|
Deploy failed, please check the logs in jenkins for more details. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| turso org switch angular-love | ||
| turso db create eu-${DB_BRANCH_NAME} --from-db $DB_MAIN_EU --group blog-eu | ||
| turso db create usw-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_WEST --group blog-us-west | ||
| turso db create use-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_EAST --group blog-us-east | ||
| """ |
There was a problem hiding this comment.
Block shell injection from DB_MAIN_ parameters*
DB_MAIN_* values come straight from Jenkins build parameters and are interpolated into the sh step without validation or quoting. A crafted value such as main-eu'; curl attacker # would piggyback onto the Turso command and execute arbitrary shell on the agent. Please whitelist acceptable characters and wrap the arguments before invoking Turso.
Apply this diff to harden the block:
- if (env.USE_PARAMS_DB == "true") {
- echo "Using params db"
- sh """
- turso org switch angular-love
- turso db create eu-${DB_BRANCH_NAME} --from-db $DB_MAIN_EU --group blog-eu
- turso db create usw-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_WEST --group blog-us-west
- turso db create use-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_EAST --group blog-us-east
- """
+ if (env.USE_PARAMS_DB == "true") {
+ echo "Using params db"
+ def allowedDbName = ~/^[A-Za-z0-9._-]+$/
+ [params.DB_MAIN_EU, params.DB_MAIN_US_WEST, params.DB_MAIN_US_EAST].each { value ->
+ if (!(value ==~ allowedDbName)) {
+ error("DB_MAIN_* params may only contain letters, numbers, '.', '_' or '-'")
+ }
+ }
+ sh """
+ turso org switch angular-love
+ turso db create eu-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_EU}' --group blog-eu
+ turso db create usw-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_US_WEST}' --group blog-us-west
+ turso db create use-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_US_EAST}' --group blog-us-east
+ """
} else {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| turso org switch angular-love | |
| turso db create eu-${DB_BRANCH_NAME} --from-db $DB_MAIN_EU --group blog-eu | |
| turso db create usw-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_WEST --group blog-us-west | |
| turso db create use-${DB_BRANCH_NAME} --from-db $DB_MAIN_US_EAST --group blog-us-east | |
| """ | |
| if (env.USE_PARAMS_DB == "true") { | |
| echo "Using params db" | |
| // Whitelist DB_MAIN_* values to prevent shell injection | |
| def allowedDbName = ~/^[A-Za-z0-9._-]+$/ | |
| [params.DB_MAIN_EU, params.DB_MAIN_US_WEST, params.DB_MAIN_US_EAST].each { value -> | |
| if (!(value ==~ allowedDbName)) { | |
| error("DB_MAIN_* params may only contain letters, numbers, '.', '_' or '-'") | |
| } | |
| } | |
| sh """ | |
| turso org switch angular-love | |
| turso db create eu-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_EU}' --group blog-eu | |
| turso db create usw-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_US_WEST}' --group blog-us-west | |
| turso db create use-${DB_BRANCH_NAME} --from-db '${params.DB_MAIN_US_EAST}' --group blog-us-east | |
| """ | |
| } else { |
🤖 Prompt for AI Agents
In Jenkinsfile.deploy around lines 143-147, the DB_MAIN_* variables are
interpolated directly into the sh block allowing shell injection; validate each
DB_MAIN_* value against a whitelist (e.g. only allow letters, numbers, dots,
dashes and underscores via a strict regex) and fail the build if validation
fails, then use the validated values when constructing the turso commands and
wrap each argument in proper shell-safe quoting (or pass them as separate,
quoted arguments) so untrusted characters cannot break out of the command.
|
PR is detected, will deploy to dev environment |
|
Deployed to dev environment |
Summary by CodeRabbit
New Features
Chores