my-rook-config

Files

T

History

Joshua Hoblitt 55a4543bc4 core: shell-quote command strings passed to sh -c

Two call sites build a shell command by interpolating values that were
never shell-quoted, so a value holding a metacharacter is executed
rather than passed along: RadosNamespaceHasObjects joins the finalized
rados argument vector with spaces, and CopyLocalFileToContainer
interpolates the destination path into a redirect.

Neither has misbehaved so far because rook composes both values itself,
not because the inputs are constrained to shell-safe characters.
CopyLocalFileToContainer receives a temp-file path. The rados probe
receives a "<metadataPoolName>:<zone><suffix>" string assembled by
adjustZoneDefaultPools, whose pool half comes from the default pool
placement's metadataPoolName or from spec.sharedPools.metadataPoolName,
neither of which carries pattern validation, or from the zone JSON of a
zone rook adopted rather than created.

Quote both with FormatCommand.

Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>

2026-08-05 10:50:51 -07:00

test

core: run gofumpt on all files

2025-03-26 10:41:48 -07:00

error_test.go

ceph: embed the buffer in the error

2021-02-03 17:28:47 +01:00

error.go

core: run gofumpt on all files

2025-03-26 10:41:48 -07:00

exec_pod.go

core: shell-quote command strings passed to sh -c