ENT-13535: Added packages promiser sanitation#5967
Conversation
|
@cf-bottom Jenkins with exotics please :) |
|
Sure, I triggered a build: (with exotics) Jenkins: https://ci.cfengine.com/job/pr-pipeline/13092/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-13092/ |
|
@cf-bottom Jenkins with exotics please :) |
|
Sure, I triggered a build: (with exotics) Jenkins: https://ci.cfengine.com/job/pr-pipeline/13093/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-13093/ |
|
^ Known failure ENT-12953 |
cf-agent/verify_packages.c
Outdated
| * # Comment character, can truncate commands | ||
| * \n \r Newlines can inject additional commands | ||
| */ | ||
| const char *shell_metacharacters = ";|&`$(){}[]<>!#*?~\\'\"\n\r"; |
There was a problem hiding this comment.
Ah, I do think the tilde is likely too strict and needed for some package names. I remember @nickanderson mentioning it I think. I checked OpenBSD and Debian and your list seems fine for those based on a simple package name search, but not on the other ways to specify package names with meta information maybe like versions and such.
Maybe a better way here is to have a default in C code that is maybe too strict and add a common attribute that can override that default so folks can make a choice without changing C code.
Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech>
I also refactored the code to use a dynamic buffer when assembling the commands. Estimating the buffer size needed is error prone and can quickly lead to buffer overflows. Ticket: ENT-13535 Changelog: Title Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech>
|
@cf-bottom Jenkins please :) |
|
Alright, I triggered a build: Jenkins: https://ci.cfengine.com/job/pr-pipeline/13120/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-13120/ |
… quoting arguments Ticket: ENT-13535 Changelog: none (cherry picked from commit 6f97d0a)
|
@cf-bottom Jenkins please :) |
|
Alright, I triggered a build: Jenkins: https://ci.cfengine.com/job/pr-pipeline/13149/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-13149/ |
3 participants
Ticket: ENT-13535
Signed-off-by: Lars Erik Wik lars.erik.wik@northern.tech
Backported to: