From 1a71d9d33cc6939e716e7ece61e9c01c0803e228 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Tue, 13 Oct 2026 11:38:51 -0300
Subject: [PATCH] fix(packimage): refuse an image directory that the shell
 would split

packimage passes the image directory to shell commands without quotes,
such as the rm -rf of the xcatpost directory. It finds its abandoned
stages with glob. For an image directory such as
"/install/custom images/node", the shell and glob split the path at the
space, so packimage removed /install/custom with the images in it.

packimage now refuses an image directory whose path has a space or a
shell character, before it runs any command.
---
 xCAT-server/lib/xcat/plugins/packimage.pm | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xCAT-server/lib/xcat/plugins/packimage.pm b/xCAT-server/lib/xcat/plugins/packimage.pm
index 506482909..071592d0e 100644
--- a/xCAT-server/lib/xcat/plugins/packimage.pm
+++ b/xCAT-server/lib/xcat/plugins/packimage.pm
@@ -196,6 +196,13 @@ sub process_request {
     }
     $rootimg_dir = "$destdir/rootimg";
 
+    # packimage passes the image directory through the shell, which splits a path at a space and expands other
+    # characters, so a command such as rm -rf would act on another path.
+    if ($destdir =~ /[\s'"`\$;&|<>()\\*?\[\]{}]/x) {
+        $callback->({ error => ["Cannot pack the image in $destdir: its path has a space or a shell character"], errorcode => [1] });
+        return 1;
+    }
+
     my $is_openeuler = $osver =~ /^openeuler/;
     if ($is_openeuler) {
         unless (defined(xCAT::Utils::normalize_openeuler_version(substr($osver, 9)))