WorkflowEventBinding Parameter from json doesn't work with % symbol

[jrobertson-insite]

Summary

In a WorkflowEventBinding Parameter, the value is passed through Go's fmt library more than once. This causes all of Go's fmt specifiers to be applied to the user specified input.

In my case when the parameter has a value of payload.sqlQuery, and payload.sqlQuery has a value of SELECT * FROM test WHERE Name LIKE '%MyName%' we see this value in the actual workflow submitted as SELECT * FROM test WHERE Name LIKE '%!M(MISSING)yName%!(NOVERB)'.

I'm unsure if this is intended or not. If you submit the same workflow through the UI with the same values you send in via json it gives the value without going through fmt twice and trying to parse the percent modifiers.

Example

WorkflowEventBinding Parameter Input (via json): %MyName%

Submitted Workflow Parameter Input (from WorkflowEventBinding)

actual: %!M(MISSING)yName%!(NOVERB)
expected: %MyName%

The real world use case for this is passing an sql query into a workflow event binding. Where we use the % symbol in the LIKE clause. To work around we're just manually encoding the percent symbol on the sender's side.

What version of Argo Workflows are you running?
v3.2.2

Diagnostics

See test cases on my fork

Or this can be used to reproduce locally.

apiVersion: argoproj.io/v1alpha1
kind: WorkflowEventBinding
metadata:
  name: test-binding
spec:
  event:
    selector: discriminator == "test"
  submit:
    workflowTemplateRef:
      name: someTemplate
    metadata:
    arguments:
      parameters:
      - name: myQuery
        valueFrom:
          event: payload.sqlQuery

JSON payload for event submitted to argo workflows

{
  "sqlQuery": "SELECT * FROM test WHERE Name LIKE '%MyName%'"
}

What executor are you running? Docker/K8SAPI/Kubelet/PNS/Emissary
Emissary

Logs from the workflow controller:

No relevant logs. Workflow is submitted with myQuery variable as
SELECT * FROM test WHERE Name LIKE '%!M(MISSING)yName%!(NOVERB)'
rather than what I expect
SELECT * FROM test WHERE Name LIKE '%MyName%'

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[alexec]

This smells of injection vulnerability.

[alexec]

The fix for this, I think, is this:

func (i Item) Format(s fmt.State, _ rune) {
	_, _ = fmt.Fprintf(s, "%s", i.String()) //nolint
}

@jrobertson-insite you seem to have a good handle on the code and tests? Would you like to submit a PR?

[jrobertson-insite]

Sure. I'll have a deeper look and submit a PR.