From 2cc76f4f94ba8c0031fda7d7b2bc7f93e4c6bfa1 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Wed, 12 Aug 2026 18:46:45 +0000
Subject: [PATCH] =?UTF-8?q?verify(P0):=20code=20review=20=E2=80=94=20secur?=
 =?UTF-8?q?ity+correctness=20=E2=80=94=20fix=20Step=205b=20heredoc=20shell?=
 =?UTF-8?q?-var=20injection?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Step 5b kyverno-json block used a single-quoted heredoc (<<'PY') but
referenced $WORK and $CONTRACT_ID inside the Python body as literal
strings — neither variable expanded, so kj scan ran against the literal
filename "$WORK/tfshow.json" (FileNotFoundError) and recorded contractId
"$CONTRACT_ID" verbatim. The entire Step 5b plan-JSON policy pass was
silently broken whenever kj was installed (it only "worked" in the
kj-absent skip path, which the tests exercise).

Fix: pass the two values as argv (python3 - "$WORK/tfshow.json"
"$CONTRACT_ID" <<'PY') and read them via sys.argv. This preserves the
single-quoted heredoc (no shell expansion into Python source — avoids a
payload-injection vector if $CONTRACT_ID ever contained a quote) while
correctly threading the values into the engine.

---ci---
project: acdl
phase: 5
milestone: v1.25-kyverno-json
status: verify
lessons:
  - P0 fix applied: Step 5b heredoc <<'PY' prevented $WORK/$CONTRACT_ID
    expansion → kj scan read literal filename, Step 5b silently broken
    whenever kj installed. Re-threaded via sys.argv (also closes a
    payload-injection vector vs naively unquoting the heredoc).
---/ci---
---
 scripts/run_platform.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index a51a59b..a27889f 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -533,7 +533,7 @@ if command -v kj >/dev/null 2>&1; then
   if [ -f "$TF_DIR/tfplan" ]; then
     terraform -chdir="$TF_DIR" show -json tfplan > "$WORK/tfshow.json" 2>/dev/null || true
     if [ -s "$WORK/tfshow.json" ]; then
-      python3 - <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
+      python3 - "$WORK/tfshow.json" "$CONTRACT_ID" <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
 import json, sys
 from pathlib import Path
 sys.path.insert(0, ".")
@@ -541,10 +541,11 @@ import importlib.util
 _spec = importlib.util.spec_from_file_location("kj_engine", "adapters/kyverno-json/kyverno_json_engine.py")
 _mod = importlib.util.module_from_spec(_spec)
 _spec.loader.exec_module(_mod)
+_payload_path, _contract_id = sys.argv[1], sys.argv[2]
 eng = _mod.KyvernoJsonEngine()
 if not eng.is_configured():
     print("[]"); sys.exit(0)
-out = eng.evaluate(json.load(open("$WORK/tfshow.json")), Path("adapters/kyverno-json/policies/plan-json"), "$CONTRACT_ID")
+out = eng.evaluate(json.load(open(_payload_path)), Path("adapters/kyverno-json/policies/plan-json"), _contract_id)
 print(json.dumps(out))
 PY
       if [ -s "$WORK/kj-pcr.json" ]; then