From b62c52b597688cb27a1911353839a19c8f15d808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:12:12 -0300
Subject: [PATCH] fix(xcatd): refuse the ^ file operator on an unauthenticated
 request

xcatd expands the request noderange before it authorizes the caller: once to
count the nodes, and once in validate() to match the policy rules. The ^
operator makes xcatd open a caller-named file at that point. A client can
connect without a certificate, because the listener does not require one, and
such a client has no peername.

Expand these two pre-authorization noderanges with nofile when the caller has
no peername (checked with defined, so the identity "0" still counts as
authenticated). If validate() finds a rejected ^file atom on such a request,
deny it. An authenticated caller expands ^file as before.
---
 xCAT-server/lib/perl/xCAT/xcatd.pm | 5 ++++-
 xCAT-server/sbin/xcatd             | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/xCAT-server/lib/perl/xCAT/xcatd.pm b/xCAT-server/lib/perl/xCAT/xcatd.pm
index bfe235174..5960f8e7c 100644
--- a/xCAT-server/lib/perl/xCAT/xcatd.pm
+++ b/xCAT-server/lib/perl/xCAT/xcatd.pm
@@ -98,7 +98,10 @@ sub validate {
 
     my %req_noderange_info;
     if (defined $request->{noderange}->[0]) {
-        my @tmpn = xCAT::NodeRange::noderange($request->{noderange}->[0]);
+        my @tmpn = xCAT::NodeRange::noderange($request->{noderange}->[0], 1, 1, (defined($peername) ? () : (nofile => 1)));
+        if (!defined($peername) && xCAT::NodeRange::file_operator_rejected()) {
+            return 0;
+        }
         $req_noderange_info{leftnodenum} = @tmpn;
         if($req_noderange_info{leftnodenum}){
             $req_noderange_info{leftnodes} =  \@tmpn;
diff --git a/xCAT-server/sbin/xcatd b/xCAT-server/sbin/xcatd
index d1e27025d..f6b1308d8 100755
--- a/xCAT-server/sbin/xcatd
+++ b/xCAT-server/sbin/xcatd
@@ -2843,7 +2843,7 @@ sub service_connection {
             }
 
              if (exists($req->{noderange}) && defined($req->{noderange}->[0])) {
-                my @nnodes = xCAT::NodeRange::noderange($req->{noderange}->[0]);
+                my @nnodes = xCAT::NodeRange::noderange($req->{noderange}->[0], 1, 1, (defined($peername) ? () : (nofile => 1)));
                 $numofnodes = (scalar(@nnodes));
             }