[Joeri-Abbo]

Vulnerability

In build/task.yml, the coverage task interpolated {{.CODE_COVERAGE_FILE_EXCLUSIONS}} directly into shell strings:

• grep -v '…' inside the -coverpkg=$(…) substitution, where a single quote in the value ends the argument.
• echo "CODE_COVERAGE_FILE_EXCLUSIONS: …", where " or $(…) in the value is expanded.

The value comes from the golang-unit-tests-exclusions action input. If a consumer wires untrusted text into that input, the coverage step, which holds the token, runs attacker-supplied shell. Severity is low because it needs a consumer to pass untrusted input.

Fix

Both sinks now use Task's shellQuote template function, so the value is emitted as one safely escaped shell word and is never parsed as code:

• grep -v -e {{shellQuote .CODE_COVERAGE_FILE_EXCLUSIONS}}. The -e stops a pattern starting with - from being read as an option.
• printf 'CODE_COVERAGE_FILE_EXCLUSIONS: %s\n' {{shellQuote …}}, replacing the echo with double quotes.

Regex behaviour is unchanged for normal values. shellQuote exists in Task 3.54.0, which action.yml pins (task-version default).

How to verify

1. Run task remote:coverage with CODE_COVERAGE_FILE_EXCLUSIONS set to \(cmd\/app\|internal\/app\). The -coverpkg list should still omit those packages, and the echoed line should print the value unchanged.
2. Run it with a hostile value such as x' ; touch /tmp/pwned ; echo '. /tmp/pwned should not be created, and the value should print literally.
3. Check the rendered command with task --dry remote:coverage if you want to see the quoting.

Not verified by execution: this session had no shell, so the change was checked by reading only.

[ergousha]

Tried shellQuote on task 3.54: the normal regex still filters the same packages and a value with quotes/; touch just gets printed, nothing runs. LGTM.