fix(prowler): contain secret CLI environments (#422)

Author: Kakudou

prowler/prowler/_core/cli_engine/adapters/binary_resolver.py

@@ -13,6 +13,10 @@ class WhichBinaryResolver:
     def validate(self, specification: ExecutionSpecification) -> ResolutionError | None:
         """Check the executable using only the specification environment."""
         path = dict(specification.environment).get("PATH")
+        if path is not None and not isinstance(path, str):
+            return ResolutionError(
+                "PATH must be an ordinary non-blank string when provided"
+            )
         if not Path(specification.executable).is_absolute() and (
             not path or not path.strip()
         ):

prowler/prowler/_core/cli_engine/adapters/subprocess_executor.py

@@ -2,6 +2,8 @@
 
 import subprocess
 
+from pydantic import SecretStr
+
 from ..contracts import ExecutionSpecification, ProcessOutcome
 from ..errors import ExecutionError
 
@@ -13,14 +15,18 @@ def execute(
         self, specification: ExecutionSpecification
     ) -> ProcessOutcome | ExecutionError:
         """Capture exact bytes and envelope startup and timeout failures."""
+        environment = {
+            name: value.get_secret_value() if isinstance(value, SecretStr) else value
+            for name, value in specification.environment
+        }
         try:
             completed = subprocess.run(  # noqa: S603 - policy-approved structured argv
                 specification.argv,
                 input=specification.input_bytes,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 cwd=specification.working_directory,
-                env=dict(specification.environment),
+                env=environment,
                 timeout=specification.timeout_seconds,
                 shell=False,
                 check=False,
@@ -37,6 +43,6 @@ def execute(
             return ExecutionError(
                 "process could not be started",
                 kind="process_start_failed",
-                cause=f"{type(error).__name__}: {error}",
+                cause=type(error).__name__,
             )
         return ProcessOutcome(completed.returncode, completed.stdout, completed.stderr)

prowler/prowler/_core/cli_engine/contracts.py

@@ -4,6 +4,10 @@
 from dataclasses import dataclass
 from typing import Any
 
+from pydantic import SecretStr
+
+EnvironmentValue = str | SecretStr
+
 
 @dataclass(frozen=True)
 class OutputSpecification:
@@ -19,7 +23,7 @@ class ValidatedCommandRequest:
 
     executable: str
     arguments: Sequence[str]
-    environment: Mapping[str, str] | Sequence[tuple[str, str]]
+    environment: Mapping[str, EnvironmentValue] | Sequence[tuple[str, EnvironmentValue]]
     working_directory: str | None
     input_bytes: bytes
     output: OutputSpecification
@@ -33,7 +37,7 @@ class ExecutionSpecification:
 
     executable: str
     arguments: tuple[str, ...]
-    environment: tuple[tuple[str, str], ...]
+    environment: tuple[tuple[str, EnvironmentValue], ...]
     working_directory: str | None
     input_bytes: bytes
     output: OutputSpecification