nuageinit: validate set-name to prevent shell injection in variable names

Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.

This commit is contained in:

Baptiste Daroussin

2026-06-09 16:24:56 +02:00

parent 09d068e527

commit 13fb6dbc73

1 changed files with 6 additions and 2 deletions

libexec/nuageinit/nuageinit

+6 -2

View File

@@ -429,8 +429,12 @@ local function network_config(obj)
 				local ifaces = get_ifaces_by_mac()
 				local matched = ifaces[v.match.macaddress]
 				if matched and matched == interface then
 					network:write("ifconfig_" .. interface .. "_name=" .. nuage.shell_escape(v["set-name"]) .. "\n")
 					interface = v["set-name"]
 					if not v["set-name"]:match("^[a-zA-Z0-9]+$") then
 						nuage.warn("set-name contains invalid characters, ignoring: " .. v["set-name"])
 					else
 						network:write("ifconfig_" .. interface .. "_name=" .. nuage.shell_escape(v["set-name"]) .. "\n")
 						interface = v["set-name"]
 					end
 				end
 			end
 			if v.dhcp4 then