3 people d504b5a815 fix(hostman): harden deployer command execution against shell injection (#25498) ...

- Quote the heredoc delimiter when writing deploy params to the
  deployer guest, so deploy content, passwords and other
  user-supplied values are written literally and shell expansions
  ($(...), backticks, $VAR) inside them are not evaluated by the
  remote shell
- Escape JSON passed via --deploy-params as a single POSIX shell
  word, preventing single quotes in user data from breaking out of
  the argument
- Add unit tests covering injection payloads

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 10:55:54 +08:00

..

aiproxy

Feat/aiproxy model context window (#25479)

2026-09-02 17:43:29 +08:00

ansibleserver

fix: support ansible galaxy mirror (#24986)

2026-06-08 08:56:48 +08:00

apigateway

fix: apigateway returns cors_hosts to browser (#25493)

2026-09-03 00:50:14 +08:00

apihelper

fix: vpc distributes static routes (#25211)

2026-07-23 19:11:38 +08:00

apimap

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

apis

fix(webconsole): harden climc shell command execution against injection (#25496)

2026-09-03 10:52:21 +08:00

appsrv

fix(mcp-server): support forwarding mcp-server request (#25191)

2026-07-21 13:27:43 +08:00

baremetal

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloudcommon

fix(cloudcommon): fix err shadowing in GetPropertyDistinctField (#25470)

2026-09-02 15:58:03 +08:00

cloudevent

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudid

fix(cloudid): batch detach policy (#25164)

2026-07-16 19:27:50 +08:00

cloudir

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudmon

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloudnet

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

cloudproxy

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

cloutpost

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

compute

fix(region): disable startrun snapshotsCleanup (#25447)

2026-09-02 15:59:06 +08:00

controller/autoscaling

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

devtool

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

dns

fix: upgrade coredns to v1.10.1 at 4.0 (#24619)

2026-04-08 16:26:50 +08:00

esxi

feat(aiproxy): add aiproxy (#25003)

2026-06-09 18:54:54 +08:00

hostimage

fix(region,host): optimize snapshot delete (#25438)

2026-08-27 16:27:29 +08:00

hostman

fix(hostman): harden deployer command execution against shell injection (#25498)

2026-09-03 10:55:54 +08:00

httperrors

fix: change OutOfResource http status code to 507 (#23987)

2025-12-29 10:59:10 +08:00

i18n

fix(region): add translate (#19137)

2024-01-02 16:49:18 +08:00

image

fix(glance): avoid receive notify when glance restart (#25410)

2026-08-24 15:05:08 +08:00

keystone

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

lbagent

fix(lbagent): generate valid UDP health check config (#25287)

2026-08-07 14:31:10 +08:00

llm

feat(llm): add llm_sku clone API and climc support (#25443)

2026-08-27 19:01:03 +08:00

logger

fix(logger): add syslog init log (#24555)

2026-03-26 18:11:22 +08:00

mcclient

fix(webconsole): harden climc shell command execution against injection (#25496)

2026-09-03 10:52:21 +08:00

mcp-server

fix: mcp streamable (#25311)

2026-08-13 16:37:29 +08:00

monitor

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

notify

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

proxy

fix(mcp-server): support forwarding mcp-server request (#25191)

2026-07-21 13:27:43 +08:00

s3gateway

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

scheduledtask

fix(mcclient,region): add tasks mod, service app options (#24734)

2026-04-29 23:48:06 +08:00

scheduler

fix: unhandled errors (#25375)

2026-08-20 17:30:16 +08:00

util

fix(region,host): optimize snapshot delete (#25438)

2026-08-27 16:27:29 +08:00

vpcagent

fix: dhcp distribute static routes on condition (#25296)

2026-08-10 10:31:33 +08:00

webconsole

fix(webconsole): harden climc shell command execution against injection (#25496)

2026-09-03 10:52:21 +08:00

yunionconf

fix(yunionconf): batch import tags (#25117)

2026-07-09 16:43:06 +08:00