fix(security): sanitize certificate file names when using legacy WireServer endpoint

[Cameron Meissner (cameronmeissner)]

What this PR does / why we need it:

sanitize certificate file names when using legacy WireServer endpoint

Which issue(s) this PR fixes:

Fixes #

[github-actions]

Windows Unit Test Results

  3 files   18 suites   1m 10s ⏱️
581 tests 581 ✅ 0 💤 0 ❌
586 runs  586 ✅ 0 💤 0 ❌

Results for commit 6a99dea.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

Linux certificate output is broken, and Windows can report success after rejecting every certificate.

2 open issues

• Fix certificate file redirection and PEM decoding · New
• Return failure when no legacy certificates are imported · New

What changed in this PR

Hardens legacy WireServer certificate filename handling in Linux and Windows node provisioning.

Changes:

• Reduces certificate filenames to their final path component.
• Skips empty filenames on Windows and empty or dot-directory names on Linux.

File	Description
staging/​cse/​windows/​kubernetesfunc.ps1	Sanitizes legacy certificate filenames before writing.
parts/​linux/​cloud-init/​artifacts/​init-aks-cloud.sh	Sanitizes filenames and modifies certificate output handling.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Linux filename security boundary needs regression tests for path sanitization, rejected names, and valid certificate output.

1 open issue

• Return failure when no legacy certificates are imported

1 previously missed issue

In code that hasn't changed since last review

Add regression coverage for legacy certificate name validation

parts/​linux/​cloud-init/​artifacts/​init-aks-cloud.sh:194

🟡 Medium Risk — 🧪 Test Coverage: Neither existing init_aks_cloud ShellSpec suite exercises retrieve_legacy_certs, leaving the new path sanitization and rejection branch without regression coverage. Add mocked legacy responses covering normal .cer names, absolute and traversal paths, and empty, . and .. names. Assert that rejected names produce no writes, accepted files stay inside the certificate directory, and certificate contents and .crt conversion are preserved. Use a temporary directory, following the staging-path relocation in init_aks_cloud_logging_spec.sh:158-163.

1 resolved since last review

• Fix certificate file redirection and PEM decoding

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Both legacy paths can report success after rejecting every certificate, and the Linux filename filter lacks regression coverage.

3 open issues

• Add regression tests for legacy certificate filename filtering · New
• Reports success after staging no installable certificates · New
• Returns success when all legacy certificates are rejected · New

1 resolved since last review

• Return failure when no legacy certificates are imported

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Linux can mismatch certificate names and bodies, while Windows reports success when all legacy filenames are rejected.

2 open issues

• Parallel-array parsing mismatches certificate names and bodies · New
• Zero-import responses incorrectly report success with -FailOnError · New

3 resolved since last review

• Returns success when all legacy certificates are rejected
• Reports success after staging no installable certificates
• Add regression tests for legacy certificate filename filtering

_{Review effort: Balanced}

[github-actions]

Package	Line Rate	Health
parts_windows Package 1	73%	➖
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
test	0%	❌
windows	27%	❌
Summary	38% (1649 / 6831)	❌

[github-actions]

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	72%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	88%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	0%	❌
github.com/Azure/agentbaker/pkg/agent	77%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	78%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	74% (5657 / 7592)	➖

[github-actions]

Package	Line Rate	Health
shellspec spec	28%	❌
Summary	28% (4507 / 15927)	❌

[Copilot]

🔵 Needs a closer look

Windows legacy handling still reports success when every certificate is rejected, even with -FailOnError.

No open issues 🎉

2 resolved since last review

• Zero-import responses incorrectly report success with -FailOnError
• Parallel-array parsing mismatches certificate names and bodies

_{Review effort: Balanced}