|
 |
b3a75e |
From b14467358acacb5ff492f2df29c2c76abb9df180 Mon Sep 17 00:00:00 2001
|
|
|
b3a75e |
From: Tomas Jelinek <tojeline@redhat.com>
|
|
|
b3a75e |
Date: Tue, 20 Mar 2018 15:39:40 +0100
|
|
|
b3a75e |
Subject: [PATCH 1/3] get rid of --debug when calling local pcsd
|
|
|
b3a75e |
|
|
|
b3a75e |
---
|
|
|
b3a75e |
pcsd/pcsd.rb | 15 ++++++++++-----
|
|
|
b3a75e |
1 file changed, 10 insertions(+), 5 deletions(-)
|
|
|
b3a75e |
|
|
|
b3a75e |
diff --git a/pcsd/pcsd.rb b/pcsd/pcsd.rb
|
|
|
b3a75e |
index 8f5ad819..b6a7435c 100644
|
|
|
b3a75e |
--- a/pcsd/pcsd.rb
|
|
|
b3a75e |
+++ b/pcsd/pcsd.rb
|
|
|
b3a75e |
@@ -239,8 +239,13 @@ post '/run_pcs' do
|
|
|
b3a75e |
}
|
|
|
b3a75e |
return JSON.pretty_generate(result)
|
|
|
b3a75e |
end
|
|
|
b3a75e |
- # do not reveal potentialy sensitive information
|
|
|
b3a75e |
- command_decoded.delete('--debug')
|
|
|
b3a75e |
+ # Do not reveal potentially sensitive information: remove --debug and all its
|
|
|
b3a75e |
+ # prefixes since getopt parser in pcs considers them equal to --debug.
|
|
|
b3a75e |
+ debug_items = ["--de", "--deb", "--debu", "--debug"]
|
|
|
b3a75e |
+ command_sanitized = []
|
|
|
b3a75e |
+ command_decoded.each { |item|
|
|
|
b3a75e |
+ command_sanitized << item unless debug_items.include?(item)
|
|
|
b3a75e |
+ }
|
|
|
b3a75e |
|
|
|
b3a75e |
allowed_commands = {
|
|
|
b3a75e |
['cluster', 'auth', '...'] => {
|
|
|
b3a75e |
@@ -341,9 +346,9 @@ post '/run_pcs' do
|
|
|
b3a75e |
allowed = false
|
|
|
b3a75e |
command_settings = {}
|
|
|
b3a75e |
allowed_commands.each { |cmd, cmd_settings|
|
|
|
b3a75e |
- if command_decoded == cmd \
|
|
|
b3a75e |
+ if command_sanitized == cmd \
|
|
|
b3a75e |
or \
|
|
|
b3a75e |
- (cmd[-1] == '...' and cmd[0..-2] == command_decoded[0..(cmd.length - 2)])
|
|
|
b3a75e |
+ (cmd[-1] == '...' and cmd[0..-2] == command_sanitized[0..(cmd.length - 2)])
|
|
|
b3a75e |
then
|
|
|
b3a75e |
allowed = true
|
|
|
b3a75e |
command_settings = cmd_settings
|
|
|
b3a75e |
@@ -372,7 +377,7 @@ post '/run_pcs' do
|
|
|
b3a75e |
options = {}
|
|
|
b3a75e |
options['stdin'] = std_in if std_in
|
|
|
b3a75e |
std_out, std_err, retval = run_cmd_options(
|
|
|
b3a75e |
- @auth_user, options, PCS, *command_decoded
|
|
|
b3a75e |
+ @auth_user, options, PCS, *command_sanitized
|
|
|
b3a75e |
)
|
|
|
b3a75e |
result = {
|
|
|
b3a75e |
'status' => 'ok',
|
|
|
b3a75e |
--
|
|
|
b3a75e |
2.13.6
|
|
|
b3a75e |
|