Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-73406

fix: use quote with command, shell and validate with variable

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • rhel-system-roles-1.94.1-0.1.el9
    • No
    • Low
    • rhel-sst-system-roles
    • rhel-sst-system-roles
    • 0
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • None
    • Enhancement
    • Hide
      .`sshd` RHEL system role validates commands and configurations

      The `sshd` role uses the `quote` command when using the `command` or `shell` plugins to ensure you can use these commands safely. The role also validates certain user-supplied role variables passed to these plugins. This improves the security and robustness of using the role because, without validation, user-supplied variables that contain white space could split and not function correctly.
      Show
      .`sshd` RHEL system role validates commands and configurations The `sshd` role uses the `quote` command when using the `command` or `shell` plugins to ensure you can use these commands safely. The role also validates certain user-supplied role variables passed to these plugins. This improves the security and robustness of using the role because, without validation, user-supplied variables that contain white space could split and not function correctly.
    • Done
    • None

      This is the replacement for the stale PR #245, where the reporter never came back to fix the CI issues, but we still consider that useful change.

      Enhancement: Use quote command when calling shell/command modules.

      Reason: The user suplied variables could split if they contain whitespace and cause unexpected behavior.

      Result: User input is validated.

      Issue Tracker Tickets (Jira or BZ if any): -

              rmeggins@redhat.com Richard Megginson
              rmeggins@redhat.com Richard Megginson
              Richard Megginson Richard Megginson
              David Jez David Jez
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: