kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

iucvterm/ts-shell: Validate guest name before constructing the audit file

Browse Source 
The guest name is provided on the CLI and needs to be validated before
the file path to the session audit file is constructed.

Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Hendrik Brueckner
2026-07-06 13:59:28 +02:00
committed by Jan Höppner
parent e6de495daa
commit c911419121
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
iucvterm/bin/ts-shell.in
View File

@@ -237,7 +237,7 @@ sub loadAuthorization(\%)
} elsif ($key =~ /^@(\S+)$/) {
my $group = $1;
$authorized = 1 if grep {/^${group}$/} @{$cfg->{groups}};
$authorized = 1 if grep {/^\Q${group}\E$/} @{$cfg->{groups}};
log_debug "Found group: $key" if $authorized;
}
@@ -406,7 +406,15 @@ sub get_auditlog_file($$$)
}
}
$$filepath = "$cfg->{auditdir}/$cfg->{user}/" . uc $guest . "_";
# validate and sanitize guest directory
$guest = uc $guest;
unless ($guest =~ /^([A-Z0-9@#\$_-]{1,8})$/) {
log_error "Creating session file path failed for guest: $guest";
return 0; # return error
}
# construct the file path
$$filepath = "$cfg->{auditdir}/$cfg->{user}/" . $guest . "_";
$$filepath .= strftime '%F-%H%M%S', localtime;
log_debug "Session transcript file: $$filepath";