OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos

[dobsonj]

Ignore these two snyk errors. They're helper functions for unit tests that append arguments to a test command. Does not pose a risk to real clusters.

 ✗ [Low] Command Injection
   ID: 6efa8846-bd0f-46b7-872d-479a06965d19 
   Path: pkg/diskmaker/discovery/discovery_test.go, line 23 
   Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.
 ✗ [Low] Command Injection
   ID: 16da69c5-18b4-434d-88fd-0cb7bd283704 
   Path: pkg/internal/diskutil_test.go, line 32 
   Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-local-storage-operator-master-security/1745954193371303936

/cc @openshift/storage

[openshift-ci[bot]]

@dobsonj: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to [this](https://github.com/openshift/local-storage-operator/pull/465): >Ignore these two snyk errors. They're helper functions for unit tests that append arguments to a test command. Does not pose a risk to real clusters. > >``` > ✗ [Low] Command Injection > ID: 6efa8846-bd0f-46b7-872d-479a06965d19 > Path: pkg/diskmaker/discovery/discovery_test.go, line 23 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. > ✗ [Low] Command Injection > ID: 16da69c5-18b4-434d-88fd-0cb7bd283704 > Path: pkg/internal/diskutil_test.go, line 32 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. >``` > >from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-local-storage-operator-master-security/1745954193371303936 > >/cc @openshift/storage > Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-27242, which is valid.

3 validation(s) were run on this bug

* bug is open, matching expected state (open) * bug target version (4.16.0) matches configured target version for branch (4.16.0) * bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (wduan@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to [this](https://github.com/openshift/local-storage-operator/pull/465): >Ignore these two snyk errors. They're helper functions for unit tests that append arguments to a test command. Does not pose a risk to real clusters. > >``` > ✗ [Low] Command Injection > ID: 6efa8846-bd0f-46b7-872d-479a06965d19 > Path: pkg/diskmaker/discovery/discovery_test.go, line 23 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. > ✗ [Low] Command Injection > ID: 16da69c5-18b4-434d-88fd-0cb7bd283704 > Path: pkg/internal/diskutil_test.go, line 32 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. >``` > >from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-local-storage-operator-master-security/1745954193371303936 > >/cc @openshift/storage > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Flocal-storage-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/local-storage-operator/blob/master/OWNERS)~~ [dobsonj] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[openshift-ci[bot]]

@dobsonj: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).

[jsafrane]

/lgtm

[openshift-ci-robot]

@dobsonj: Jira Issue OCPBUGS-27242: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/vmware-vsphere-csi-driver-operator#213 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-27242 has not been moved to the MODIFIED state.

In response to [this](https://github.com/openshift/local-storage-operator/pull/465): >Ignore these two snyk errors. They're helper functions for unit tests that append arguments to a test command. Does not pose a risk to real clusters. > >``` > ✗ [Low] Command Injection > ID: 6efa8846-bd0f-46b7-872d-479a06965d19 > Path: pkg/diskmaker/discovery/discovery_test.go, line 23 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. > ✗ [Low] Command Injection > ID: 16da69c5-18b4-434d-88fd-0cb7bd283704 > Path: pkg/internal/diskutil_test.go, line 32 > Info: Unsanitized input from a CLI argument flows into os.exec.Command, where it is used as a shell command. This may result in a Command Injection vulnerability. >``` > >from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-local-storage-operator-master-security/1745954193371303936 > >/cc @openshift/storage > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Flocal-storage-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build local-storage-operator-container-v4.16.0-202401191549.p0.g569393f.assembly.stream for distgit local-storage-operator. All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-01-21-092529