Merge Outstanding Security MRs

Axel von Bertoldirequested to merge
avonbertoldi/merge-security-mrs into main

This MR merges https://gitlab.com/gitlab-org/security/gitlab-runner/-/merge_requests/71+ into this repo. From the original MR:

What does this MR do?

  • Ensures that GITLAB_ENV file is removed at the start and end of jobs.
  • For bash/sh shells, no longer uses source to export GITLAB_ENV variables. This is safer, as source could execute scripts inside the GITLAB_ENV file. We now read each line of the file and export it.

Why was this MR needed?

https://gitlab.com/gitlab-org/gitlab-runner/-/issues/36991#note_1681880344

What's the best way to test this MR?

Integration test has been updated to detect the problem. It tested against previous version should error.

What are the relevant issue numbers?

Closes https://gitlab.com/gitlab-org/gitlab-runner/-/issues/36991

Edited by Axel von Bertoldi

Merge request reports