fix operator security: path escape + sendEvent app-key bypass

- ArgoCD executor: use url.PathEscape for app name in API paths to
  prevent path traversal
- Datadog executor: use url.PathEscape for monitor ID in mute path
- Datadog executor: allow sendEvent to bypass app-key gate since it
  only needs DD-API-KEY (doPost with needsAppKey=false)

Made-with: Cursor

Author: ramanv0

pkg/argocd_executor/argocd_executor.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -323,7 +324,7 @@ func (e *ArgoCDExecutor) getAppStatus(ctx context.Context, req *v1.DatadogQueryR
 		zap.String("request_id", req.RequestId),
 		zap.String("app_name", appName))
 
-	path := fmt.Sprintf("/api/v1/applications/%s", appName)
+	path := fmt.Sprintf("/api/v1/applications/%s", url.PathEscape(appName))
 	body, code, err := e.doGet(ctx, path)
 	return e.makeResponse(req.RequestId, body, code, err)
 }
@@ -348,7 +349,7 @@ func (e *ArgoCDExecutor) syncApp(ctx context.Context, req *v1.DatadogQueryReques
 		zap.String("request_id", req.RequestId),
 		zap.String("app_name", appName))
 
-	path := fmt.Sprintf("/api/v1/applications/%s/sync", appName)
+	path := fmt.Sprintf("/api/v1/applications/%s/sync", url.PathEscape(appName))
 	body, code, err := e.doPost(ctx, path, []byte(syncBody))
 	return e.makeResponse(req.RequestId, body, code, err)
 }

pkg/datadog_executor/datadog_executor.go

@@ -89,7 +89,10 @@ func (e *DatadogExecutor) ExecuteQuery(ctx context.Context, req *v1.DatadogQuery
 	e.mu.RLock()
 	hasAppKey := e.appKey != ""
 	e.mu.RUnlock()
-	if !hasAppKey {
+
+	// sendEvent only needs the API key; all other operations require the app key
+	needsAppKey := req.QueryType != v1.DatadogQueryType_DATADOG_SEND_EVENT
+	if needsAppKey && !hasAppKey {
 		e.Logger.Warn("Datadog query requires app key but none available",
 			zap.String("request_id", req.RequestId),
 			zap.String("query_type", req.QueryType.String()))
@@ -775,7 +778,7 @@ func (e *DatadogExecutor) muteMonitor(ctx context.Context, req *v1.DatadogQueryR
 		muteBody = "{}"
 	}
 
-	apiPath := fmt.Sprintf("/api/v1/monitor/%s/mute", monitorID)
+	apiPath := fmt.Sprintf("/api/v1/monitor/%s/mute", url.PathEscape(monitorID))
 	e.Logger.Info("[Datadog] Muting monitor",
 		zap.String("request_id", req.RequestId),
 		zap.String("monitor_id", monitorID))