SSH key pairs are very buggy
- 主要语言
- Java
- 星标
- 3.1k
- 派生
- 1.4k
- 平均合并
- 6 天 19 小时
- 30 天内合并 PR
- 32
描述
### problem
Having the ssh key pairs being identified by their name leads to a lot of weird issues.
1. The key pair validator allows commas(and other special characters like an ampersand) in the key pair name.
2. The `deployVirtualMachine` command `keypairs` parameter isn't escaped, this breaks on key pairs containing commas.
4. The `deployVirtualMachine` command `keypair` works with commas
5. The UI breaks when a key pair contains commas, below is a single key containing a bunch of commas
6. If the API consumer assumes the key pair name is safe and validated by cloudstack it *cloud* lead to a command injection(but it requires a lot of wrong assumptions)
### versions
CloudStack 4.22.0.0
### The steps to reproduce the bug
You can use the UI to observe most of the issues:
1. Create a new key pair with a comma in the name eg. `test, test`
2. Try creating a new instance with said key
### What to do about it?
1. Add a new `keypairId` array parameter to all the endpoint which access key pair name.
2. Mark the `keypair` and `keypairs` parameters deprecated.
贡献指南
调研方向
首先跟踪接受或访问密钥对名称的 API 端点,然后通过 UI 和 deployVirtualMachine 命令复现包含逗号的密钥对。识别所有受影响的端点及其现有的 keypair/keypairs 参数。完成的标准是:所需的 keypairId 数组参数可用,并且基于名称的参数被标记为 deprecated,同时不破坏文档中描述的工作流。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- java
- 领域
- api, backend-api-design
- Issue 类型
- 缺陷
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 43/100