3 people d504b5a815 fix(hostman): harden deployer command execution against shell injection (#25498) ...

- Quote the heredoc delimiter when writing deploy params to the
  deployer guest, so deploy content, passwords and other
  user-supplied values are written literally and shell expansions
  ($(...), backticks, $VAR) inside them are not evaluated by the
  remote shell
- Escape JSON passed via --deploy-params as a single POSIX shell
  word, preventing single quotes in user data from breaking out of
  the argument
- Add unit tests covering injection payloads

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 10:55:54 +08:00

..

doc.go

Automated cherry pick of #18822: Automated cherry pick of #18821: Feat/deploy guest (#18823)

2023-11-30 16:50:18 +08:00

driver_test.go

fix(hostman): harden deployer command execution against shell injection (#25498)

2026-09-03 10:55:54 +08:00

driver.go

fix(hostman): harden deployer command execution against shell injection (#25498)

2026-09-03 10:55:54 +08:00

local_driver.go

fix(host-deployer): mount procfs before deploy guestfs (#25086)

2026-07-01 00:53:31 +08:00