Damans227 commented on code in PR #14229:
URL: https://github.com/apache/cloudstack/pull/14229#discussion_r4274006008
##########
setup/bindir/cloud-setup-databases.in:
##########
@@ -418,8 +419,13 @@ for example:
def processEncryptionStuff(self):
def encrypt(value):
- cmd = ['java','-classpath','"' + self.encryptionJarPath +
'"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' +
- self.mgmtsecretkey + '"', self.encryptorVersion]
+ # runCmd() joins this list with spaces and runs it through a
shell, so each
+ # dynamic value must be shell-escaped with shlex.quote() rather
than hand-wrapped
+ # in double quotes: double quotes still let the shell expand
"$..." in the value
+ # (e.g. a password of pa$sword is truncated to pa), silently
corrupting it.
+ cmd = ['java', '-classpath', shlex.quote(self.encryptionJarPath),
+ 'com.cloud.utils.crypt.EncryptionCLI', '-i',
shlex.quote(value),
Review Comment:
can we do the same in cloud-setup-encryption? it builds this command with
double quotes too, so a $ in the password still gets cut off there
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
