Skip to content

Dagger crashes if interface names has invalid characters #1655

Description

@mattiaswal

Current Behavior

Some examples:
/: Rejected by linux (dagger crashes)
;: Command execution (dagger may crash and code execution as root)
&&: Command execution (dagger may crash and code execution as root)
and more. We should have an allowlist.

admin@infix-00-00-00:/> configure 
admin@infix-00-00-00:/config/> edit interface 
admin@infix-00-00-00:/config/> set interface 
 e1 lo
admin@infix-00-00-00:/config/> set interface d;reboot
[ OK ] Saving system clock (UTC) to RTC
[ OK ] Saving system clock to file
[ OK ] Saving random seed
[ OK ] Stopping Device event daemon (udev)
[ OK ] Stopping Configuration daemon
[ OK ] Stopping DHCP/DNS proxy
[ OK ] Stopping CLI backend daemon
[ OK ] Stopping FRR MGMT daemon

The impact is either command execution or that you get a configuration you cant get from, since dagger crash on exit as well.

The security impact is limited, even if it looks bad.

Expected Behavior

Something else

Steps To Reproduce

No response

Additional information

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingtriagePending investigation & classification (CCB)

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions