From e3e132967cfa65fc4c7544faa9b68f19b09104a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 17 Aug 2026 12:24:20 -0300
Subject: [PATCH] fix(xcatd): stop a noderange from running a command through
 the ^ operator

The ^ noderange operator reads node names from a file. NodeRange opened
that file with a two-argument open. A two-argument open reads shell
metacharacters in the path, so a noderange such as ^"id|" ran a command.
xcatd expands a noderange while it processes a request, so the command
ran on the management node.

Use a three-argument open with an explicit read mode. The value is then
only ever a file name. The ^ operator keeps working: ^/tmp/nodes still
reads the file.

This fix was recovered from the lenovobuild branch. The original there
(commit for "Remove load from file in noderange support") removed the ^
operator. This keeps the documented operator and closes the command path
instead.
---
 perl-xCAT/xCAT/NodeRange.pm | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/perl-xCAT/xCAT/NodeRange.pm b/perl-xCAT/xCAT/NodeRange.pm
index f79fcec5e..fad97cd24 100644
--- a/perl-xCAT/xCAT/NodeRange.pm
+++ b/perl-xCAT/xCAT/NodeRange.pm
@@ -678,8 +678,9 @@ sub noderange {
         if ($atom eq '') { next; }
 
         if ($atom =~ /^\^(.*)$/) {    # get a list of nodes from a file
-            open(NRF, $1);
-            while (<NRF>) {
+            my $nrfile = $1;
+            open(my $nrf, '<', $nrfile) or next;
+            while (<$nrf>) {
                 my $line = $_;
                 unless ($line =~ m/^[\^#]/) {
                     $line =~ m/^([^:	 ]*)/;
@@ -692,7 +693,7 @@ sub noderange {
                     }
                 }
             }
-            close(NRF);
+            close($nrf);
             next;
         }