Generate a SBOM for the Enterprise image

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

1 issue found across 9 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="enterprise/scripts/sbom.js">

<violation number="1" location="enterprise/scripts/sbom.js:23">
P1: Avoid interpolating the untrusted `image` argument into shell commands executed via execSync; this enables command injection. Use execFile/execFileSync with an арг array to avoid shell parsing, or validate/sanitize `image` before use.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Avoid interpolating the untrusted image argument into shell commands executed via execSync; this enables command injection. Use execFile/execFileSync with an арг array to avoid shell parsing, or validate/sanitize image before use.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At enterprise/scripts/sbom.js, line 23:

<comment>Avoid interpolating the untrusted `image` argument into shell commands executed via execSync; this enables command injection. Use execFile/execFileSync with an арг array to avoid shell parsing, or validate/sanitize `image` before use.</comment>

<file context>
@@ -0,0 +1,114 @@
+    execSync(`docker pull ${image}`, { stdio: [ "ignore", "inherit", "inherit" ] });
+  }
+
+  const container = execSync(`docker create ${image}`, { encoding: "utf-8" }).trim();
+  execSync(`docker cp ${container}:/usr/share/sourcemeta/one/npm-packages.spdx.json ${workdir}/npm.json`);
+  execSync(`docker cp ${container}:/usr/share/sourcemeta/one/vendor-packages.spdx.json ${workdir}/vendor.json`);
</file context>