vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

priv: reject colons in bind paths to avoid nspawn delimiter confusion

Browse source
This commit is contained in:
damocles 2026-06-01 17:23:33 +02:00 • committed by mara
commit 0b5376249d
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hive-priv/src/main.rs
View file

@ -359,9 +359,11 @@ fn agent_flake_ref(name: &str) -> String {
fn validate_bind_path(path: &str) -> Result<()> { fn validate_bind_path(path: &str) -> Result<()> {
if path.is_empty() if path.is_empty()
|| !path.starts_with('/') || !path.starts_with('/')
|| path.bytes().any(|b| b == 0 || b == b'\n' || b == b'"') || path.bytes().any(|b| b == 0 || b == b'\n' || b == b'"' || b == b':')
{ {
bail!("invalid bind path {path:?}: must be an absolute path with no newlines, null bytes, or double-quotes"); bail!(
"invalid bind path {path:?}: must be an absolute path with no colons, newlines, null bytes, or double-quotes"
);
} }
Ok(()) Ok(())
} }