vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

priv: reject double-quotes in nspawn flag entries

Browse source
This commit is contained in:
damocles 2026-06-01 17:20:45 +02:00 • committed by mara
commit a922376778
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hive-priv/src/main.rs
View file

@ -352,13 +352,17 @@ fn agent_flake_ref(name: &str) -> String {
format!("{META_DIR}#{name}")
}
/// Validate one nspawn flag entry: must be non-empty and contain no
/// ASCII whitespace or null bytes. Whitespace would split the entry
/// into multiple flags when the start script expands
/// `$EXTRA_NSPAWN_FLAGS` unquoted.
/// Validate one nspawn flag entry. Must be non-empty and contain no
/// ASCII whitespace (would split the entry when the start script
/// expands `$EXTRA_NSPAWN_FLAGS` unquoted), double-quotes (would
/// break the `EXTRA_NSPAWN_FLAGS="..."` conf line), or null bytes.
fn validate_nspawn_flag(flag: &str) -> Result<()> {
if flag.is_empty() || flag.bytes().any(|b| b == 0 || b.is_ascii_whitespace()) {
bail!("invalid nspawn flag {flag:?}: must be non-empty and contain no whitespace or null bytes");
if flag.is_empty()
|| flag.bytes().any(|b| b == 0 || b == b'"' || b.is_ascii_whitespace())
{
bail!(
"invalid nspawn flag {flag:?}: must be non-empty and contain no whitespace, double-quotes, or null bytes"
);
}
Ok(())
}