Pass git clean args as separate args in submodule foreach
What does this MR do?
Cherry-pick of https://gitlab.com/gitlab-org/security/gitlab-runner/-/merge_requests/106
Classified as typemaintenance / defense-in-depth per PSIRT review (see linked issues for context).
Passes each GIT_CLEAN_FLAGS value to git submodule foreach git clean as its own argv element instead of joining them into a single string. Applied at three call sites, and added regression tests.
Why was this MR needed?
GIT_CLEAN_FLAGS reaches git submodule foreach as a single argument, which the foreach evaluates via sh -c. Shell metacharacters in the variable execute as commands during source fetch when GIT_SUBMODULE_STRATEGY is normal or recursive and the project has a submodule. The same root cause is present at three locations.
What's the best way to test this MR?
go test ./shells -count=1go test -tags integration -count=1 ./functions/concrete/run/stages
Both new regression tests were verified to fail on unpatched code and pass after the fix.
What are the relevant issue numbers?
Closes https://gitlab.com/gitlab-org/gitlab-runner/-/work_items/39346, https://gitlab.com/gitlab-org/security/gitlab-runner/-/work_items/22