OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos

[dobsonj]

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

 ✗ [Medium] Path Traversal
   ID: 3fc8046c-130d-47bf-b9d9-82031d8fbb02 
   Path: release-tools/filter-junit.go, line 98 
   Info: Unsanitized input from a CLI argument flows into os.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: 2e81599a-d493-4db8-9835-c0606f80df2a 
   Path: release-tools/filter-junit.go, line 145 
   Info: Unsanitized input from a CLI argument flows into os.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.
 ✗ [Medium] Path Traversal
   ID: a20c42f1-44d5-45a2-84dd-acc9060eae9e 
   Path: release-tools/boilerplate/boilerplate.py, line 59 
   Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: a903d19e-ee2a-4b85-af57-10eba2409e2d 
   Path: release-tools/boilerplate/boilerplate.py, line 150 
   Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-csi-external-provisioner-master-security/1745954192519860224

/cc @openshift/storage

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-27242, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (wduan@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

✗ [Medium] Path Traversal
  ID: 3fc8046c-130d-47bf-b9d9-82031d8fbb02 
  Path: release-tools/filter-junit.go, line 98 
  Info: Unsanitized input from a CLI argument flows into os.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: 2e81599a-d493-4db8-9835-c0606f80df2a 
  Path: release-tools/filter-junit.go, line 145 
  Info: Unsanitized input from a CLI argument flows into os.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.
✗ [Medium] Path Traversal
  ID: a20c42f1-44d5-45a2-84dd-acc9060eae9e 
  Path: release-tools/boilerplate/boilerplate.py, line 59 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a903d19e-ee2a-4b85-af57-10eba2409e2d 
  Path: release-tools/boilerplate/boilerplate.py, line 150 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-csi-external-provisioner-master-security/1745954192519860224

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [dobsonj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dobsonj: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[jsafrane]

/lgtm

[openshift-ci-robot]

@dobsonj: Jira Issue OCPBUGS-27242: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/vmware-vsphere-csi-driver-operator#213 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-27242 has not been moved to the MODIFIED state.

In response to this:

Ignore these errors, release-tools is not part of the component that runs in production, and these reported issues do not grant the caller any extra permissions. If you can read it with release-tools then you already have access to read it without release-tools.

✗ [Medium] Path Traversal
  ID: 3fc8046c-130d-47bf-b9d9-82031d8fbb02 
  Path: release-tools/filter-junit.go, line 98 
  Info: Unsanitized input from a CLI argument flows into os.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: 2e81599a-d493-4db8-9835-c0606f80df2a 
  Path: release-tools/filter-junit.go, line 145 
  Info: Unsanitized input from a CLI argument flows into os.WriteFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write arbitrary files.
✗ [Medium] Path Traversal
  ID: a20c42f1-44d5-45a2-84dd-acc9060eae9e 
  Path: release-tools/boilerplate/boilerplate.py, line 59 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: a903d19e-ee2a-4b85-af57-10eba2409e2d 
  Path: release-tools/boilerplate/boilerplate.py, line 150 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-csi-external-provisioner-master-security/1745954192519860224

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build csi-provisioner-container-v4.16.0-202401191549.p0.g5d94212.assembly.stream for distgit csi-provisioner.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-01-21-092529