Repository navigation
[PRODENG-3920] Replace hand-rolled quoting on license, credential and reset paths - #676
Open
james-nesbitt wants to merge 1 commit into
Open
james-nesbitt wants to merge 1 commit into
james-nesbitt wants to merge 1 commit into
Conversation
… reset paths Four Linux paths built root-privileged commands with manual or no quoting: SetupLicenseFile and InstallMKE wrapped values in '...' by hand, so a single quote byte in a license file or admin password broke out into the remote shell. Both now emit shellescape.Quote'd values (the license content is also trimmed, since it is a command-line flag value). The --admin-username/--admin-password flags keep their redaction options. The Ubuntu keyring import spliced a repoURL-derived gpgURL into a sudo'd string containing $(curl ...). gpgURL is now validated with url.ParseRequestURI before use and the command is assembled by sh.Command with the substitution embedded in one quoted bash -c argument - the URL never touches the outer shell. Mirrors the sh.Command shape the SLES installer already uses. CleanupLingeringMCR built root rm -rf and umount commands from the host-reported DockerRootDir and daemon.json Root/ExecRoot with plain Sprintf. Host-reported paths must now pass isSafeRemotePath - absolute, no metacharacters, spaces, empty segments or traversal - or they are ignored with a warning; every sink (attemptPathSudoDelete and the umount at linux.go:557) builds its command with sh.Command, which quotes by construction. pkg/configurer/common.go:42 inverted its emptiness check so GetDockerDaemonConfig returned errConfigEmpty for every non-empty input, meaning daemon.json Root/ExecRoot never reached CleanupLingeringMCR at all. The condition is now correct; because the callers validate and quote the values, fixing it opens no injection path. Callers were confirmed before the fix: pkg/configurer/linux.go:556 and windows.go:484; the Windows caller already quotes through ps.SingleQuote. Covers secf_7def0007cfc6eb3b9d466843, secf_777f11c24bc0f0a56607429e, secf_8fed7df1b14f3db189694b4d. make lint 0 issues, make unit-test clean. Written by AI: claude-opus-5 Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
james-nesbitt
force-pushed
the
PRODENG-3920-replace-hand-rolled-quoting
branch
from
October 22, 2026 14:07
9eebb7c to
a53141d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replace hand-rolled quoting on the license, credential and reset command paths; fix the inverted emptiness check in
GetDockerDaemonConfig.Why
Four Linux paths built root-privileged commands with manual or no quoting, so a single quote byte in a license file or admin password broke out into the remote shell, and the host-reported docker root paths reached sudo'd
rm -rf/umountunvalidated.How
SetupLicenseFile,InstallMKEadmin credentials:shellescape.Quoteinstead of hand-rolled'...'; redactions retained.gpgURLvalidated withurl.ParseRequestURI; command rebuilt assh.Command("bash", "-c", ...), matching the SLES shape.CleanupLingeringMCR: host-reportedRoot/ExecRoot/DockerRootDirmust passisSafeRemotePathor are ignored;rm/umountsinks built withsh.Command, including the previously unguarded umount.common.go:42inverted check fixed — daemon.jsonRoot/ExecRootnever reached the reset logic; both callers verified quoting before the fix, so no injection path is opened.Testing
make unit-test: pass;make lint: 0 issues.TestIsSafeRemotePath: 18 cases covering substitution, separators, traversal, spaces, newline.TestResetCommandsQuoteHostPaths: metacharacter-bearing paths are quoted by construction.Links
Checklist
Written by AI: claude-opus-5