fix sanitization issues (#18687)
Costa Tsaousis committed
Oct 4, 2024 at 18:30 UTC
5fcf478b648a87809f0735318cd86cf383b1ac75
4 files changed
+29
-16
src/collectors/cgroups.plugin/cgroup-name.sh.in
+1
-1
@@ -610,7 +610,7 @@ function podman_validate_id() {
610
DOCKER_HOST="${DOCKER_HOST:=/var/run/docker.sock}"
611
PODMAN_HOST="${PODMAN_HOST:=/run/podman/podman.sock}"
612
CGROUP_PATH="${1}" # the path as it is (e.g. '/docker/efcf4c409')
613
-CGROUP="${2}" # the modified path (e.g. 'docker_efcf4c409')
613
+CGROUP="${2//\//_}" # the modified path (e.g. 'docker_efcf4c409')
614
EXIT_SUCCESS=0
615
EXIT_RETRY=2
616
EXIT_DISABLE=3
src/libnetdata/line_splitter/line_splitter.h
+3
@@ -57,6 +57,9 @@ static inline size_t quoted_strings_splitter(char *str, char **words, size_t max
57
while (likely(*s)) {
58
// if it is an escape
59
if (unlikely(*s == '\\' && s[1])) {
60
+ // IMPORTANT: support for escaping is incomplete!
61
+ // The backslash character needs to be removed
62
+ // from the parsed string.
63
s += 2;
64
continue;
65
}
src/libnetdata/sanitizers/chart_id_and_name.c
+20
-14
@@ -3,20 +3,26 @@
3
#include "../libnetdata.h"
4
5
/*
6
- * ! -> simple patterns negation (only when it is the first character)
7
- * " -> needs escaping when parsing
8
- * $ -> can be a shell variable (security in alarm-notify.sh)
9
- * % -> http GET encoded characters
10
- * & -> http GET fields separator
11
- * ' -> needs escaping when parsing
12
- * * -> simple pattern wildcard
13
- * + -> http GET space
14
- * , -> list separator (probably not used today)
15
- * = -> plugins.d protocol separator
16
- * ? -> http GET query string separator
17
- * @ -> hostname separator (on the UI)
18
- * ` -> bash expansion (security in alarm-notify.sh)
19
- * | -> list separator (simple patterns and http GET)
6
+ * control characters become space, which are deduplicated.
7
+ *
8
+ * Character Name Sym To Why
9
+ * ---------------- --- --- -------------------------------------------------------------------------------------
10
+ * space [ ] -> [_]
11
+ * exclamation mark [!] -> [_] (only when it is the first character) simple patterns negation
12
+ * double quotes ["] -> [_] needs escaping when parsing
13
+ * dollar [$] -> [_] health variables and security in alarm-notify.sh, cgroup-name.sh, etc.
14
+ * percent [%] -> [_] http GET encoded characters
15
+ * ampersand [&] -> [_] http GET fields separator
16
+ * single quote ['] -> [_] needs escaping when parsing
17
+ * asterisk [*] -> [_] simple pattern wildcard
18
+ * plus [+] -> [_] http GET space
19
+ * comma [,] -> [.] list separator (probably not used today)
20
+ * equal [=] -> [_] plugins.d protocol separator
21
+ * question mark [?] -> [_] http GET query string separator
22
+ * at [@] -> [_] hostname separator (on the UI)
23
+ * apostrophe [`] -> [_] bash expansion (security in alarm-notify.sh and other shell scripts)
24
+ * pipe [|] -> [_] list separator (simple patterns and http GET)
25
+ * backslash [\] -> [/] to avoid interfering with escaping logic
26
*/
27
28
unsigned char chart_names_allowed_chars[256] = {
src/libnetdata/sanitizers/chart_id_and_name.h
+5
-1
@@ -12,7 +12,11 @@ bool rrdvar_fix_name(char *variable);
12
13
extern unsigned char chart_names_allowed_chars[256];
14
static inline bool is_netdata_api_valid_character(char c) {
15
- return (IS_UTF8_BYTE(c) || chart_names_allowed_chars[(unsigned char)c] == (unsigned char)c);
15
+ if(IS_UTF8_BYTE(c)) return true;
16
+ unsigned char t = chart_names_allowed_chars[(unsigned char)c];
17
+ // the translation converts space to space
18
+ // so we have to check explicitly
19
+ return t == (unsigned char)c && t != ' ' && t != '!';
20
}
21
22
#endif //NETDATA_CHART_ID_AND_NAME_H