Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix(helm): preserve trailing newlines in literal decryption to prevent double-escaping commas#753

Open
mail2sudheerobbu-oss wants to merge 6 commits into
jkroepke:mainfrom
mail2sudheerobbu-oss:fix/752-trailing-newline-literal-comma-escaping
Open

fix(helm): preserve trailing newlines in literal decryption to prevent double-escaping commas#753
mail2sudheerobbu-oss wants to merge 6 commits into
jkroepke:mainfrom
mail2sudheerobbu-oss:fix/752-trailing-newline-literal-comma-escaping

Conversation

@mail2sudheerobbu-oss
Copy link
Copy Markdown

Problem

Fixes #752

When HELM_SECRETS_WRAPPER_ENABLED=true and a literal secret value ends with a trailing newline, the value is incorrectly double-escaped before being passed to Helm.

Root cause: Shell command substitution ($(...)) always strips trailing newlines from output. In scripts/commands/helm.sh, decrypted_literal=$(backend_decrypt_literal "${literal}") silently drops any trailing \n. The subsequent equality check [ "${decrypted_literal}" = "${literal}" ] then fails — because literal still has the newline — causing the else branch to fire and apply sed comma-escaping to a value that should pass through unchanged. This double-escapes any commas in the value.

This particularly affects ArgoCD integration where multi-line Helm parameters naturally include trailing newlines.

Fix

Use the standard shell printf sentinel idiom to preserve trailing newlines through command substitution:

decrypted_literal=$(backend_decrypt_literal "${literal}"; printf x)
decrypted_literal="${decrypted_literal%x}"

Appending printf x inside the subshell prevents the shell from stripping anything (output no longer ends with \n). ${decrypted_literal%x} then removes only the sentinel.

Also strips a single trailing newline from literal before the comparison (literal_stripped="${literal%$'\n'}") so the check is symmetric regardless of how the encrypted value was stored.

The else sed-escaping branch is left unchanged — it is only reached when genuine decryption occurred, where comma-escaping is correct.

Testing

Manually verified with a literal value ending in \n containing a comma — previously produced \,, now passes through correctly.

mail2sudheerobbu-oss and others added 4 commits April 22, 2026 13:52
…t double-escaping commas

Fixes jkroepke#752

Shell command substitution strips trailing newlines, causing
decrypted_literal to differ from literal when the value ends with \n.
The else branch then incorrectly applies sed comma-escaping.

Fix: use printf sentinel idiom to preserve trailing newlines.

Signed-off-by: Sudheer Obbu <[email protected]>
@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

Fixed the CI failures in the latest commit:

  1. shellcheck SC3003$'\\n' is not defined in POSIX sh. Replaced with a literal-newline variable assigned via single-quotes (a POSIX-compatible idiom). This also fixes the unit test failures on alpine (ash/zsh) and UBI bash 4.4, which don't support $'...' ANSI-C quoting syntax.

  2. shfmt formatting — Expanded the inline single-line subshell assignment to the multi-line form shfmt expects (backend call on one line, sentinel printf x on the next).

@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

Fixed the remaining 7 test failures in the latest commit.

Root cause: The sentinel printf x was masking the exit status of backend_decrypt_literal. Since printf x always exits 0, the if ! error check never fired on decryption failures — the template would run with an empty value instead of aborting. Test 117 ("w/ error") was catching exactly this regression.

Fix: Capture the backend exit code before appending the sentinel, then propagate it out of the subshell via exit. This preserves both the trailing-newline sentinel in the output and the correct error propagation for the outer guard.

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 28, 2026

Codecov Report

❌ Patch coverage is 63.63636% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.71%. Comparing base (41769d8) to head (84e8702).

Files with missing lines Patch % Lines
scripts/commands/helm.sh 63.63% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #753      +/-   ##
==========================================
- Coverage   87.00%   86.71%   -0.30%     
==========================================
  Files          22       22              
  Lines         862      873      +11     
==========================================
+ Hits          750      757       +7     
- Misses        112      116       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

Hi @jkroepke — ping on this one too! This fixes double-escaping of commas when helm-secrets processes multiline values with literal decryption (fixes #752). Includes a BATS regression test. No conflicts. Would appreciate a review when you get a chance. Thanks!

@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

@jkroepke — gentle ping on this PR. It fixes double-escaping of commas in Helm values when the decrypted secret ends with a trailing newline — a subtle bug where the sentinel-based literal decryption was stripping the newline before the helm call, causing a,b to become a\,b (closes #752). CI is green and branch is synced. Would appreciate a review when you get a chance! 🙏

@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

Hi @jkroepke — gentle ping on this one! All 21 CI checks are green and the branch is cleanly mergeable. This fixes double-escaping of commas when a decrypted literal value ends with a trailing newline (closes #752). Happy to adjust anything if needed. 🙏

@mail2sudheerobbu-oss
Copy link
Copy Markdown
Author

@jkroepke — gentle ping! All 21 CI checks are green and the branch merges cleanly. This fixes the double-escaping of commas when a decrypted literal value ends with a trailing newline (closes #752). The fix uses the standard sentinel idiom to preserve trailing newlines through command substitution. Happy to adjust anything. 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trailing newlines in literal breaks correct escaping of commas

2 participants