diff options
| author | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-04-16 22:30:29 +0300 |
|---|---|---|
| committer | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-09-07 19:08:35 +0300 |
| commit | 0d4fd05058a855eef627a65f2b005a7c557ae022 (patch) | |
| tree | 87ff653360f3f0cf437a8d34547a1da8779e82cc /src | |
| parent | 9698284cbe5a8515b453a58859e4c61f1a910337 (diff) | |
| download | vyos-1x-0d4fd05058a855eef627a65f2b005a7c557ae022.tar.gz vyos-1x-0d4fd05058a855eef627a65f2b005a7c557ae022.zip | |
T8497: image_installer: fix vulnarability
image_installer.py was using data from untrusted source to pass
to shell without escaping in case VRF was activated.
Change to list in call to `cmd` to fix this, remove extra code for VRF
wrappers to library parameters.
Diffstat (limited to 'src')
| -rwxr-xr-x | src/op_mode/image_installer.py | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py index fb28f182e..b325df9bd 100755 --- a/src/op_mode/image_installer.py +++ b/src/op_mode/image_installer.py @@ -737,10 +737,7 @@ def image_fetch(image_path: str, vrf: str = None, # Latest version gets url from configured "system update-check url" if image_path == 'latest': - command = external_latest_image_url_script - if vrf: - command = f'ip vrf exec {vrf} {command}' - code, output = rc_cmd(command, env=environ) + code, output = rc_cmd(external_latest_image_url_script, vrf=vrf, env=environ) if code: print(output) exit(MSG_INFO_INSTALL_EXIT) |