From 2846027dc69205e9da67fccc59612cf78b0b4bd0 Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Fri, 16 Feb 2024 15:51:50 +0100 Subject: [PATCH] machine init: validate machine name and username Validate the names with our name regex that we also use for containers/pods. While we technically do not need to be that strict, I think it makes sense to match containers. The most important bit of this validation is that we exclude the use of / and \ which breaks all our file paths as we just use this in the name an when machine write the file it ends up being in a subdir which breaks the reading side. Also other special characters could cause trouble for the URL parsing in the machine connection URL. Signed-off-by: Paul Holzinger --- cmd/podman/machine/init.go | 9 +++++++++ pkg/machine/e2e/init_test.go | 12 ++++++++++++ 2 files changed, 21 insertions(+) diff --git a/cmd/podman/machine/init.go b/cmd/podman/machine/init.go index d897822bbe..88f358d764 100644 --- a/cmd/podman/machine/init.go +++ b/cmd/podman/machine/init.go @@ -8,6 +8,7 @@ import ( "github.com/containers/common/pkg/completion" "github.com/containers/podman/v5/cmd/podman/registry" + ldefine "github.com/containers/podman/v5/libpod/define" "github.com/containers/podman/v5/libpod/events" "github.com/containers/podman/v5/pkg/machine" "github.com/containers/podman/v5/pkg/machine/define" @@ -136,6 +137,10 @@ func initMachine(cmd *cobra.Command, args []string) error { return fmt.Errorf("machine name %q must be %d characters or less", args[0], maxMachineNameSize) } initOpts.Name = args[0] + + if !ldefine.NameRegex.MatchString(initOpts.Name) { + return fmt.Errorf("invalid name %q: %w", initOpts.Name, ldefine.RegexError) + } } // The vmtype names need to be reserved and cannot be used for podman machine names @@ -143,6 +148,10 @@ func initMachine(cmd *cobra.Command, args []string) error { return fmt.Errorf("cannot use %q for a machine name", initOpts.Name) } + if !ldefine.NameRegex.MatchString(initOpts.Username) { + return fmt.Errorf("invalid username %q: %w", initOpts.Username, ldefine.RegexError) + } + // Check if machine already exists _, exists, err := shim.VMExists(initOpts.Name, []vmconfigs.VMProvider{provider}) if err != nil { diff --git a/pkg/machine/e2e/init_test.go b/pkg/machine/e2e/init_test.go index 25b0f307e8..83f0b5c9a9 100644 --- a/pkg/machine/e2e/init_test.go +++ b/pkg/machine/e2e/init_test.go @@ -66,7 +66,19 @@ var _ = Describe("podman machine init", func() { Expect(badInit).To(Exit(125)) Expect(badInit.errorToString()).To(ContainSubstring(want)) + invalidName := "ab/cd" + session, err = mb.setName(invalidName).setCmd(&i).run() + Expect(err).ToNot(HaveOccurred()) + Expect(session).To(Exit(125)) + Expect(session.errorToString()).To(ContainSubstring(`invalid name "ab/cd": names must match [a-zA-Z0-9][a-zA-Z0-9_.-]*: invalid argument`)) + + i.username = "-/a" + session, err = mb.setName("").setCmd(&i).run() + Expect(err).ToNot(HaveOccurred()) + Expect(session).To(Exit(125)) + Expect(session.errorToString()).To(ContainSubstring(`invalid username "-/a": names must match [a-zA-Z0-9][a-zA-Z0-9_.-]*: invalid argument`)) }) + It("simple init", func() { i := new(initMachine) session, err := mb.setCmd(i.withImagePath(mb.imagePath)).run()