fix(selfhost): reject compose interpolation in image (#1890)

Author: JSONbored

scripts/deploy-selfhost-image.sh

@@ -129,8 +129,8 @@ validate_inputs() {
     exit 1
   fi
   case "$image" in
-    *[[:space:]\"\'\\]*)
-      echo "error: image contains unsupported whitespace, quote, or backslash characters" >&2
+    *[[:space:]\"\'\\\$\{\}]*)
+      echo "error: image contains unsupported whitespace, quote, backslash, or compose interpolation characters" >&2
       exit 1
       ;;
   esac

test/unit/selfhost-image-deploy.test.ts

@@ -192,4 +192,23 @@ describe("self-host image deploy script", () => {
       harness.cleanup();
     }
   });
+
+  it.each([
+    "registry.example/gittensory:${GITHUB_OAUTH_CLIENT_SECRET}",
+    "registry.example/gittensory:$GITHUB_OAUTH_CLIENT_SECRET",
+    "registry.example/gittensory:{GITHUB_OAUTH_CLIENT_SECRET}",
+  ])("rejects compose interpolation characters in image %s", (image) => {
+    const { harness, result } = runHarness({ args: [image], envFile: "EXISTING=1\n" });
+    try {
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain(
+        "image contains unsupported whitespace, quote, backslash, or compose interpolation characters",
+      );
+      expect(readFileSync(harness.envPath, "utf8")).toBe("EXISTING=1\n");
+      expect(harness.readImages()).toBe("");
+      expect(harness.readCalls()).not.toContain(" pull ");
+    } finally {
+      harness.cleanup();
+    }
+  });
 });