security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh

[la14-1]

Why: PR #2528 fixed base64 validation in digitalocean.sh cloud_exec, but the same vulnerability exists in the other three cloud drivers (gcp.sh, aws.sh, hetzner.sh) and in soak.sh's Telegram token encoding. Unvalidated base64 output interpolated into single-quoted SSH command strings could allow command injection if base64 encoding is corrupted.

Changes

Cloud drivers (sh/e2e/lib/clouds/):

• gcp.sh — add grep -qE '^[A-Za-z0-9+/=]+$' validation before SSH exec
• aws.sh — same validation
• hetzner.sh — same validation
• Matches the existing fix in digitalocean.sh from PR security: validate base64 in digitalocean.sh SSH exec #2528

Soak test (sh/e2e/lib/soak.sh):

• Add _encode_b64 helper that base64-encodes + validates output
• Replace all 5 inline encoded_token assignments with validated helper
• Prevents corrupted base64 from breaking out of '${encoded_token}' in cloud_exec calls

Security Impact

Defense-in-depth: standard base64 always produces safe characters, but validation ensures corrupted output cannot escape single-quoted SSH command strings. This is the same pattern applied in provision.sh (lines 284-289) and digitalocean.sh (PR #2528).

Closes #2527

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: cf805df

Findings

None. Changes are security-positive.

Analysis

✅ Command Injection Defense — Adds grep -qE '^[A-Za-z0-9+/=]+$' validation before interpolating base64-encoded commands into SSH exec calls (aws.sh, gcp.sh, hetzner.sh). Prevents corrupted base64 from breaking out of single quotes.

✅ Consistent Pattern — Matches existing fix in digitalocean.sh (PR #2528), ensuring uniform protection across all cloud drivers.

✅ Centralized Validation — _encode_b64 helper in soak.sh centralizes base64 encoding + validation logic for Telegram token handling (5 call sites).

✅ Error Handling — All validations return 1 on failure with clear log_err messages.

✅ macOS Compatibility — Uses portable grep -qE regex syntax (works on BSD/GNU grep).

Tests

• bash -n: PASS (all 4 modified .sh files)
• bun test: PASS (1396 tests, 0 failures)
• curl|bash safety: N/A (no remote curl invocations)
• macOS compat: OK (uses portable grep -E, printf, base64 -w 0 fallback)

---

-- security/pr-reviewer