Fix CWE-78

[tdrozdovsky]

Signed-off-by: Taras Drozdovskyi t.drozdovsky@samsung.com

Description

After analyzing the existing code, it should be noted that sanitization measures have been made in the edge-orchestration:

1. analysis for a command injection using an escape sequence
2. filtering commands that are on the blacklist
3. only those commands that are previously described in the configuration file (ex. ls_srv.conf) can be executed.

Strengthening against attacks of this kind can be:

1. Using the integrity check and digital signature of the configuration file.
2. Applying Linux Kernel protection modules.

All attempts to eliminate the security alert by changing the source code were unsuccessful.
The elimination requires hard-coding the string literals of the commands to be used, but this greatly limits the flexibility of the edge-orchestration and doesn't add a significant increase in security.

Therefore, I propose to mark this alert as a fall positive.

Fixes #298

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

The result can be seen after merging the PR and restarting the LGTM

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.9% Duplication

[tiokim]

I agree with your idea.
Is there anything else we should put some in the injectionOperators?

[tdrozdovsky]

I agree with your idea.
Is there anything else we should put some in the injectionOperators?

That's enough for the moment! Thank you!

[MoonkiHong]

+1

[MoonkiHong]

@suresh-lc PTAL. 😄

[suresh-lc]

LGTM