Skip to content

fix: change gcloud orb region and zone cmds #247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jordan Ho (jordanjho) merged 1 commit into from
Feb 20, 2026
Merged

fix: change gcloud orb region and zone cmds #247

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion gcloud/orb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ commands:
default: ""
description: The Google project ID to connect with via the gcloud CLI.
type: string
region:
default: ""
description: The Google region to use via the gcloud CLI.
type: string
Comment on lines +29 to +32
Copy link

@gemini-code-assist gemini-code-assist bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The addition of the region parameter is a great improvement. However, please note that the existing jobs in this orb (such as deploy-cloud-function and deploy-gke) do not currently expose a region parameter or pass it to this auth command. Furthermore, even the existing zone parameter is not passed to auth in those jobs. To make these features fully functional for users of those jobs, they should be updated to accept and pass these parameters to the auth command.

zone:
default: ""
description: The Google zone to use via the gcloud CLI.
Expand All @@ -37,10 +41,14 @@ commands:
condition: <<parameters.project>>
steps:
- run: gcloud --quiet config set project "<<parameters.project>>"
- when:
condition: <<parameters.region>>
steps:
- run: gcloud --quiet config set compute/region "<<parameters.region>>"
Copy link

@gemini-code-assist gemini-code-assist bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

This line is vulnerable to command injection. The region parameter is directly used in the gcloud command without proper escaping, allowing an attacker to execute arbitrary shell commands by manipulating the parameter value. This could lead to unauthorized access or data exfiltration. While addressing this critical security issue, also consider that Cloud Functions typically respects the functions/region property. It's recommended to set both compute/region and functions/region to ensure consistent regional application across services, using environment variables for safe parameter passing for both.

            - run:
                name: set compute/region
                command: gcloud --quiet config set compute/region "$REGION"
                environment:
                  REGION: <<parameters.region>>
References
  1. Parameters passed to shell commands should always be handled via environment variables to prevent command injection vulnerabilities, as direct substitution can lead to arbitrary code execution.

- when:
condition: <<parameters.zone>>
steps:
- run: gcloud --quiet config set zone "<<parameters.zone>>"
- run: gcloud --quiet config set compute/zone "<<parameters.zone>>"
Copy link

@gemini-code-assist gemini-code-assist bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The auth command in the CircleCI orb uses string parameters region and zone directly in shell commands without proper escaping or sanitization. Specifically, the parameters are substituted into the command string within double quotes. If an attacker can control the value of these parameters (e.g., via a branch name or other untrusted input), they can break out of the double quotes and execute arbitrary shell commands.

Impact: An attacker could execute arbitrary commands in the CI/CD environment, potentially leading to the theft of sensitive credentials (like the GCP service key), modification of build artifacts, or unauthorized deployments.

Remediation: Use environment variables to pass parameter values to shell commands. This prevents the shell from interpreting the parameter value as part of the command structure.

            - run:
                name: set compute/zone
                command: gcloud --quiet config set compute/zone "$ZONE"
                environment:
                  ZONE: <<parameters.zone>>


configure-docker:
description: >
Expand Down