On Tue 12 May 07:53, Baptiste Daroussin wrote: > The branch main has been updated by bapt: > > URL: > https://cgit.FreeBSD.org/src/commit/?id=8b70a203be10411c560ed303ab25713d70b316e9 > > commit 8b70a203be10411c560ed303ab25713d70b316e9 > Author: Baptiste Daroussin <[email protected]> > AuthorDate: 2026-05-07 18:22:14 +0000 > Commit: Baptiste Daroussin <[email protected]> > CommitDate: 2026-05-12 07:52:32 +0000 > > nuageinit: fix command injection and related issues > > - Add shell_escape() helper to safely escape shell arguments > - Apply shell_escape to all user-controlled values in shell commands: > adduser (usershow, useradd, lock, primary_group, groups) > addgroup (groupshow, groupadd, members) > exec_change_password (usermod) > settimezone (tzsetup root and timezone) > install_package (pkg package names) > - Escape double quotes in hostname when writing rc.conf.d/hostname > - Add missing 'local' declaration for resolvconf_command in nameservers() > - Escape interface name in resolvconf -a command > - Change open_resolvconf_conf() from 'w' to 'a' mode to prevent > data loss when nameservers() is called multiple times > - Clean up stale resolvconf.conf at the start of each boot > (skip on postnet to preserve config written by first call) > > MFC After: 1 day
Part of this has been reported by: Yazdan Soltani <[email protected]> sorry I forgot to mention. Best regards, Bapt
