Language: TypeScript
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
function createTestYamlDeployment(
  newYamlPath: string,
  imageNameAndTag: string,
  imagePullPolicy: string,
  clusterName: string,
): void {
  console.log('Creating YAML snyk-monitor deployment...');
  const originalDeploymentYaml = readFileSync(
    './snyk-monitor-deployment.yaml',
    'utf8',
  );
  const deployment = parse(originalDeploymentYaml);

  const container = deployment.spec.template.spec.containers.find(
    (container) => container.name === 'snyk-monitor',
  );
  container.image = imageNameAndTag;
  container.imagePullPolicy = imagePullPolicy;

  // Inject the baseUrl of kubernetes-upstream that snyk-monitor container use to send metadata
  const envVar = container.env.find(
    (env) => env.name === 'SNYK_INTEGRATION_API',
  );
  envVar.value = 'https://kubernetes-upstream.dev.snyk.io';
  delete envVar.valueFrom;

  if (clusterName) {
    const clusterNameEnvVar = container.env.find(
      (env) => env.name === 'SNYK_CLUSTER_NAME',
    );
    clusterNameEnvVar.value = clusterName;
    delete clusterNameEnvVar.valueFrom;
  }

  writeFileSync(newYamlPath, stringify(deployment));
  console.log('Created YAML snyk-monitor deployment');
}