From 88f1779aec1204fa394d2620a71ccc3ac0948eda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:06:55 -0300
Subject: [PATCH] fix(genesis): validate generated network state

---
 .../files/genesis-network-state               | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/xCAT-genesis-builder/oe/meta-xcat-genesis/recipes-core/xcat-genesis-init/files/genesis-network-state b/xCAT-genesis-builder/oe/meta-xcat-genesis/recipes-core/xcat-genesis-init/files/genesis-network-state
index cd6a8f10f..cd0dca1f5 100644
--- a/xCAT-genesis-builder/oe/meta-xcat-genesis/recipes-core/xcat-genesis-init/files/genesis-network-state
+++ b/xCAT-genesis-builder/oe/meta-xcat-genesis/recipes-core/xcat-genesis-init/files/genesis-network-state
@@ -84,6 +84,15 @@ netmask_to_prefix() {
     printf '%s\n' "$prefix"
 }
 
+validate_state_value() {
+    local name=$1 value=$2
+
+    [[ $value =~ ^[][A-Za-z0-9._,:/%+-]*$ ]] \
+        || fail_network UNSAFE_NETWORK_STATE \
+            "Unsafe value returned for $name" \
+            'Check DHCP, routing, and resolver data from the management network'
+}
+
 destination=
 boot_mac=
 host_ip=
@@ -301,6 +310,19 @@ mac_address=
     || read -r mac_address <"$sys_class_net/$selected_interface/address"
 verified_seconds=$(genesis_uptime_seconds "$uptime_file")
 
+validate_state_value XCATDEST "$destination"
+validate_state_value XCATMASTER "$master"
+validate_state_value XCATPORT "$port"
+validate_state_value XCAT_INTERFACE "$selected_interface"
+validate_state_value XCAT_SOURCE_ADDRESS "$source_address"
+validate_state_value XCAT_SOURCE_PREFIXED_ADDRESS "$source_prefixed_address"
+validate_state_value XCAT_GATEWAY "$actual_gateway"
+validate_state_value XCAT_DNS_SERVERS "$dns_servers"
+validate_state_value XCAT_NETWORK_METHOD "$network_method"
+validate_state_value XCAT_LINK_STATE "$link_state"
+validate_state_value XCAT_MAC_ADDRESS "$mac_address"
+validate_state_value XCAT_VERIFIED_SECONDS "$verified_seconds"
+
 mkdir -p "$state_dir"
 chmod 0755 "$state_dir"
 umask 077