The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxd/pull/7856
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
From cbb45c93212db3d2897e7c33e8d6e3e91f65b41d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgra...@ubuntu.com>
Date: Fri, 11 Sep 2020 18:39:07 -0400
Subject: [PATCH 1/2] validate: Consider + as unsafe in URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Stéphane Graber <stgra...@ubuntu.com>
---
shared/validate/validate.go | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shared/validate/validate.go b/shared/validate/validate.go
index 0ae2d5986f..2db3f92efd 100644
--- a/shared/validate/validate.go
+++ b/shared/validate/validate.go
@@ -403,7 +403,7 @@ func IsNetworkMTU(value string) error {
// IsURLSegmentSafe validates whether value can be used in a URL segment.
func IsURLSegmentSafe(value string) error {
- for _, char := range []string{"/", "?", "&"} {
+ for _, char := range []string{"/", "?", "&", "+"} {
if strings.Contains(value, char) {
return fmt.Errorf("Cannot contain %q", char)
}
From 34d341eb0f7f54d005d43660be190085d3a63245 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgra...@ubuntu.com>
Date: Fri, 11 Sep 2020 18:42:55 -0400
Subject: [PATCH 2/2] lxd/instance/snapshots: Restrict naming
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Make sure the snapshot names are valid in URLs.
Signed-off-by: Stéphane Graber <stgra...@ubuntu.com>
---
lxd/instance_snapshot.go | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/lxd/instance_snapshot.go b/lxd/instance_snapshot.go
index 557ebfa91f..e54c90f741 100644
--- a/lxd/instance_snapshot.go
+++ b/lxd/instance_snapshot.go
@@ -7,10 +7,10 @@ import (
"io/ioutil"
"net/http"
"net/url"
- "strings"
"time"
"github.com/gorilla/mux"
+ "github.com/pkg/errors"
"github.com/lxc/lxd/lxd/db"
"github.com/lxc/lxd/lxd/instance"
@@ -22,6 +22,7 @@ import (
"github.com/lxc/lxd/lxd/util"
"github.com/lxc/lxd/shared"
"github.com/lxc/lxd/shared/api"
+ "github.com/lxc/lxd/shared/validate"
"github.com/lxc/lxd/shared/version"
)
@@ -133,8 +134,9 @@ func containerSnapshotsPost(d *Daemon, r *http.Request)
response.Response {
}
// Validate the name
- if strings.Contains(req.Name, "/") {
- return response.BadRequest(fmt.Errorf("Snapshot names may not
contain slashes"))
+ err = validate.IsURLSegmentSafe(req.Name)
+ if err != nil {
+ return response.BadRequest(errors.Wrap(err, "Invalid snapshot
name"))
}
fullName := name +
@@ -401,8 +403,9 @@ func snapshotPost(d *Daemon, r *http.Request, sc
instance.Instance, containerNam
}
// Validate the name
- if strings.Contains(newName, "/") {
- return response.BadRequest(fmt.Errorf("Snapshot names may not
contain slashes"))
+ err = validate.IsURLSegmentSafe(newName)
+ if err != nil {
+ return response.BadRequest(errors.Wrap(err, "Invalid snapshot
name"))
}
fullName := containerName + shared.SnapshotDelimiter + newName
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
