xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-10-21 15:18:19 +00:00
Code Issues Releases Wiki Activity

fix(packimage): refuse an image directory that the shell would split

Browse Source 
packimage passes the image directory to shell commands without quotes,
such as the rm -rf of the xcatpost directory. It finds its abandoned
stages with glob. For an image directory such as
"/install/custom images/node", the shell and glob split the path at the
space, so packimage removed /install/custom with the images in it.

packimage now refuses an image directory whose path has a space or a
shell character, before it runs any command.
This commit is contained in:
Vinícius Ferrão
2026-10-13 11:38:51 -03:00
parent be9c063981
commit 1a71d9d33c
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT-server/lib/xcat/plugins/packimage.pm
+7
View File
@@ -196,6 +196,13 @@ sub process_request {
}
$rootimg_dir = "$destdir/rootimg";
# packimage passes the image directory through the shell, which splits a path at a space and expands other
# characters, so a command such as rm -rf would act on another path.
if ($destdir =~ /[\s'"`\$;&|<>()\\*?\[\]{}]/x) {
$callback->({ error => ["Cannot pack the image in $destdir: its path has a space or a shell character"], errorcode => [1] });
return 1;
}
my $is_openeuler = $osver =~ /^openeuler/;
if ($is_openeuler) {
unless (defined(xCAT::Utils::normalize_openeuler_version(substr($osver, 9)))