The nbd export endpoints interpolated the request disk_id into
shell commands (sh -c with the joined qemu-nbd command line, and
ps|grep for the process check), so a crafted disk_id could execute
arbitrary commands as root on the host image service.
- Require the disk_id to be a plain UUID in both export and close
endpoints
- Run qemu-nbd with argv instead of sh -c
- Check the export process via its pid file and kill -0 instead of
shell pipelines
- Add unit tests for the validation and the process check
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
server-monitor sends arbitrary QMP/HMP commands (pmemsave, migrate,
etc.) to a running guest, which exceeds the semantics of monitoring.
As an MCP tool it could be triggered without human awareness through
LLM prompt injection or the tool-request endpoint.
Remove the mcp-desc registration tag from ServerMonitorOptions so
climcgen no longer registers the tool, drop its mention from the MCP
instructions, and add a regression test asserting it is not exposed.
The climc command and the permission-gated region API are unchanged.
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
Full session tokens were written to logs in policy.go, mcclient auth,
oidc handler and the webconsole session manager; guest root passwords
were logged by the linux fsdriver and the nbdkit mount command; MCP
tool arguments and full JSON-RPC bodies (which may contain
server-reset-password passwords) were logged by the llm agent.
Truncate tokens in log messages, drop or mask password values and
log only the tool/method name for MCP calls.
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Quote the heredoc delimiter when writing deploy params to the
deployer guest, so deploy content, passwords and other
user-supplied values are written literally and shell expansions
($(...), backticks, $VAR) inside them are not evaluated by the
remote shell
- Escape JSON passed via --deploy-params as a single POSIX shell
word, preventing single quotes in user data from breaking out of
the argument
- Add unit tests covering injection payloads
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Run ssh via exec.Command argv instead of "bash -c" string
interpolation, so user-supplied fields can no longer escape into
local shell commands on the webconsole server
- Quote every interpolated value (env, command, args) as a POSIX
shell word, so they stay literal data on the remote shell
- Validate username charset and limit target_ip to climc pod or container
- Add unit tests covering injection payloads
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
* feat(aiproxy): expose catalog context window on AI models
Populate known 1M+ context windows in catalog seed data and return
context_window in AI model list/detail API responses.
* feat(aiproxy): add instance test-connectivity and set-models actions
Add provider instance test-connectivity using stored ai_key secrets,
and set-models to import selected catalog models while skipping
existing model_key rows. Register corresponding climc perform commands.
Only call tryUnmanageInterface when the slave interface has IPv4 or IPv6
addresses configured, avoiding unnecessary NetworkManager unmanage on
address-less interfaces during bridge setup.
