KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

nuageinit: validate set-name to prevent shell injection in variable names

Browse Source 
Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.
This commit is contained in:
Baptiste Daroussin
2026-06-09 16:24:56 +02:00
parent 09d068e527
commit 13fb6dbc73
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libexec/nuageinit/nuageinit
+6 -2
View File
@@ -429,8 +429,12 @@ local function network_config(obj)
local ifaces = get_ifaces_by_mac() local ifaces = get_ifaces_by_mac()
local matched = ifaces[v.match.macaddress] local matched = ifaces[v.match.macaddress]
if matched and matched == interface then if matched and matched == interface then
network:write("ifconfig_" .. interface .. "_name=" .. nuage.shell_escape(v["set-name"]) .. "\n") if not v["set-name"]:match("^[a-zA-Z0-9]+$") then
interface = v["set-name"] nuage.warn("set-name contains invalid characters, ignoring: " .. v["set-name"])
else
network:write("ifconfig_" .. interface .. "_name=" .. nuage.shell_escape(v["set-name"]) .. "\n")
interface = v["set-name"]
end
end end
end end
if v.dhcp4 then if v.dhcp4 then