3 people 4ba761aa29 fix(hostimage): harden nbd export against command injection (#25530) ...

The nbd export endpoints interpolated the request disk_id into
shell commands (sh -c with the joined qemu-nbd command line, and
ps|grep for the process check), so a crafted disk_id could execute
arbitrary commands as root on the host image service.

- Require the disk_id to be a plain UUID in both export and close
  endpoints
- Run qemu-nbd with argv instead of sh -c
- Check the export process via its pid file and kill -0 instead of
  shell pipelines
- Add unit tests for the validation and the process check

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 23:47:54 +08:00

..

aiproxy

Feat/aiproxy model context window (#25479)

2026-09-02 17:43:29 +08:00

ansibleserver

fix: support ansible galaxy mirror (#24986)

2026-06-08 08:56:48 +08:00

apigateway

fix: mask tokens and passwords in logs (#25513)

2026-09-03 19:20:36 +08:00

apihelper

fix: vpc distributes static routes (#25211)

2026-07-23 19:11:38 +08:00

apimap

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

apis

feat(llm): support cancel and resume for instant model import (#25519)

2026-09-03 20:14:23 +08:00

appsrv

fix(mcp-server): support forwarding mcp-server request (#25191)

2026-07-21 13:27:43 +08:00

baremetal

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloudcommon

fix: mask tokens and passwords in logs (#25513)

2026-09-03 19:20:36 +08:00

cloudevent

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudid

fix(cloudid): batch detach policy (#25164)

2026-07-16 19:27:50 +08:00

cloudir

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudmon

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloudnet

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudproxy

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloutpost

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

compute

fix(region): vmware vm nic sync (#25508)

2026-09-03 18:27:27 +08:00

controller/autoscaling

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

devtool

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

dns

fix: upgrade coredns to v1.10.1 at 4.0 (#24619)

2026-04-08 16:26:50 +08:00

esxi

feat(aiproxy): add aiproxy (#25003)

2026-06-09 18:54:54 +08:00

hostimage

fix(hostimage): harden nbd export against command injection (#25530)

2026-09-03 23:47:54 +08:00

hostman

fix: mask tokens and passwords in logs (#25513)

2026-09-03 19:20:36 +08:00

httperrors

fix: change OutOfResource http status code to 507 (#23987)

2025-12-29 10:59:10 +08:00

i18n

fix(region): add translate (#19137)

2024-01-02 16:49:18 +08:00

image

fix(glance): avoid receive notify when glance restart (#25410)

2026-08-24 15:05:08 +08:00

keystone

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

lbagent

fix(lbagent): generate valid UDP health check config (#25287)

2026-08-07 14:31:10 +08:00

llm

feat(llm): support cancel and resume for instant model import (#25519)

2026-09-03 20:14:23 +08:00

logger

fix(logger): add syslog init log (#24555)

2026-03-26 18:11:22 +08:00

mcclient

fix(mcp-server): do not expose server-monitor as an MCP tool (#25511)

2026-09-03 19:22:19 +08:00

mcp-server

fix(mcp-server): do not expose server-monitor as an MCP tool (#25511)

2026-09-03 19:22:19 +08:00

monitor

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

notify

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

proxy

fix(mcp-server): support forwarding mcp-server request (#25191)

2026-07-21 13:27:43 +08:00

s3gateway

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

scheduledtask

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

scheduler

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

util

feat(llm): support cancel and resume for instant model import (#25519)

2026-09-03 20:14:23 +08:00

vpcagent

fix: dhcp distribute static routes on condition (#25296)

2026-08-10 10:31:33 +08:00

webconsole

fix: mask tokens and passwords in logs (#25513)

2026-09-03 19:20:36 +08:00

yunionconf

fix(yunionconf): batch import tags (#25117)

2026-07-09 16:43:06 +08:00