Package com.atlassian.bamboo.security.validation

Interface RepositoryVariableSecurityValidator

All Known Implementing Classes:

RepositoryVariableSecurityValidatorImpl

public interface RepositoryVariableSecurityValidator

Validates repository-sourced variable values for shell injection risks.

Customer-controlled data (branch names, PR source/target branches, PR keys) is used verbatim in build variable substitution. Allowing shell metacharacters in these values can lead to command injection on build agents (VULN-1826023).

Allowed characters: [a-zA-Z0-9_./-] Everything else is rejected.

Method Summary

Modifier and Type	Method	Description
@NotNull SecurityValidationResult	validateBranchName(@NotNull String branchName, @NotNull PartialVcsRepositoryData repositoryData, @Nullable ImmutableChain plan)	Validates a branch name received from a VCS repository.
@NotNull SecurityValidationResult	validateBranchNameForUI(@Nullable String branchName)	Validates a branch name received from a VCS repository.
@NotNull SecurityValidationResult	validatePullRequestMetadata(@Nullable String sourceBranch, @Nullable String targetBranch, @Nullable String key, @Nullable VcsRepositoryData sourceRepositoryData, @Nullable VcsRepositoryData targetRepositoryData)	Validates the branch names and key associated with a pull request.

Method Details

validateBranchName

@NotNull
@NotNull SecurityValidationResult validateBranchName(@NotNull
 @NotNull String branchName,
 @NotNull
 @NotNull PartialVcsRepositoryData repositoryData,
 @Nullable
 @Nullable ImmutableChain plan)

Validates a branch name received from a VCS repository.

Parameters:

branchName - the branch name to validate; null or empty is allowed

Returns:

allowed result if the name is safe, blocked result otherwise

validateBranchNameForUI

@NotNull
@NotNull SecurityValidationResult validateBranchNameForUI(@Nullable
 @Nullable String branchName)

Validates a branch name received from a VCS repository.

Parameters:

branchName - the branch name to validate; null or empty is allowed

Returns:

allowed result if the name is safe, blocked result otherwise Doesn't emit the security violation notification

validatePullRequestMetadata

@NotNull
@NotNull SecurityValidationResult validatePullRequestMetadata(@Nullable
 @Nullable String sourceBranch,
 @Nullable
 @Nullable String targetBranch,
 @Nullable
 @Nullable String key,
 @Nullable
 @Nullable VcsRepositoryData sourceRepositoryData,
 @Nullable
 @Nullable VcsRepositoryData targetRepositoryData)

Validates the branch names and key associated with a pull request.

Parameters:

sourceBranch - PR source branch; null or empty is allowed

targetBranch - PR target branch; null or empty is allowed

key - PR key/identifier; null or empty is allowed

sourceRepositoryData - source repository metadata for security auditing/logging context; may be null

targetRepositoryData - target repository metadata for security auditing/logging context; may be null

Returns:

allowed result if all fields are safe, blocked result otherwise