fix(buildkite): validate BUILDKITE_BRANCH to prevent command injection

buildkite/pipeline_generator/global_config.py

@@ -37,6 +37,11 @@ def init_global_config(pipeline_config_path: str):
         pipeline_config["github_repo_name"] = "vllm-project/vllm"
 
     branch = os.getenv("BUILDKITE_BRANCH")
+    if branch:
+        if not re.match(r"^[a-zA-Z0-9._/-]+$", branch):
+            raise ValueError(
+                f"Invalid branch name: {branch}. Contains disallowed characters."
+            )
     pull_request = os.getenv("BUILDKITE_PULL_REQUEST")
     merge_base_commit = get_merge_base_commit()
     list_file_diff = get_list_file_diff(branch, merge_base_commit)

buildkite/tests/pipeline_generator/test_global_config.py

@@ -0,0 +1,63 @@
+import pytest
+from unittest.mock import patch, mock_open
+import os
+from buildkite.pipeline_generator.global_config import init_global_config
+
+
+@pytest.fixture(autouse=True)
+def reset_config():
+    import buildkite.pipeline_generator.global_config
+
+    buildkite.pipeline_generator.global_config.config = None
+
+
+@patch(
+    "buildkite.pipeline_generator.global_config.get_merge_base_commit",
+    return_value="sha",
+)
+@patch(
+    "buildkite.pipeline_generator.global_config.get_list_file_diff",
+    return_value=[],
+)
+@patch(
+    "buildkite.pipeline_generator.global_config.get_pr_labels", return_value=[]
+)
+@patch(
+    "builtins.open",
+    new_callable=mock_open,
+    read_data="name: test\njob_dirs: [/tmp]\nregistries: reg\nrepositories: {main: repo}",
+)
+@patch("os.path.exists", return_value=True)
+def test_init_global_config_valid_branch(
+    mock_exists, mock_open, mock_pr_labels, mock_diff, mock_mb
+):
+    with patch.dict(
+        os.environ, {"BUILDKITE_BRANCH": "valid-branch-name_123/pkg"}
+    ):
+        init_global_config("dummy_path")
+        # Should succeed
+
+
+@patch(
+    "buildkite.pipeline_generator.global_config.get_merge_base_commit",
+    return_value="sha",
+)
+@patch(
+    "buildkite.pipeline_generator.global_config.get_list_file_diff",
+    return_value=[],
+)
+@patch(
+    "buildkite.pipeline_generator.global_config.get_pr_labels", return_value=[]
+)
+@patch(
+    "builtins.open",
+    new_callable=mock_open,
+    read_data="name: test\njob_dirs: [/tmp]\nregistries: reg\nrepositories: {main: repo}",
+)
+@patch("os.path.exists", return_value=True)
+def test_init_global_config_invalid_branch(
+    mock_exists, mock_open, mock_pr_labels, mock_diff, mock_mb
+):
+    with patch.dict(os.environ, {"BUILDKITE_BRANCH": "invalid;branch"}):
+        with pytest.raises(ValueError, match="Invalid branch name"):
+            init_global_config("dummy_path")