Problem
Rollback removes promoted assets with rm -rf using asset names passed through shell word splitting. The current asset sources appear intended to be controlled, but the destructive helper does not validate that each asset is a simple relative filename.
Evidence
remove_promoted_files loops over promoted_files and runs:
rm -rf "${install_dir}/${asset}"Expected behavior
Validate rollback asset names before deletion: no empty values, no slashes, no .., no absolute paths, and ideally only the known expected release asset names.
Labels
bug, security
Problem
Rollback removes promoted assets with
rm -rfusing asset names passed through shell word splitting. The current asset sources appear intended to be controlled, but the destructive helper does not validate that each asset is a simple relative filename.Evidence
remove_promoted_filesloops overpromoted_filesand runs:rm -rf "${install_dir}/${asset}"Expected behavior
Validate rollback asset names before deletion: no empty values, no slashes, no
.., no absolute paths, and ideally only the known expected release asset names.Labels
bug,security