admin/CLICD
1
0
Fork 0
mirror of https://github.com/MengMengCode/CLICD.git synced 2026-08-04 21:31:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复剩余 CodeQL 高危告警

Browse Source
This commit is contained in:
MengMengCode
2026-07-18 21:31:31 +08:00
parent 04cefe0cf1
commit 6bdeafccf2
3 changed files with 14 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/kvm/kvm_test.go
+8 -6
View File
@@ -3,6 +3,7 @@ package kvm
import ( import (
"crypto/ed25519" "crypto/ed25519"
"crypto/rand" "crypto/rand"
"path/filepath"
"reflect" "reflect"
"testing" "testing"
@@ -11,14 +12,15 @@ import (
"golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh"
) )
func TestLocalImageIDRejectsPathExpressions(t *testing.T) { func TestImagePathUsesAllowlistedImageID(t *testing.T) {
for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute"} { for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute", "unknown-image"} {
if got := localImageID(id); got != "__invalid_image_id__" { if got := filepath.Base(ImagePath(id)); got != "__invalid_image_id__.qcow2" {
t.Fatalf("localImageID(%q) = %q", id, got) t.Fatalf("ImagePath(%q) basename = %q", id, got)
} }
} }
if got := localImageID("debian-13-kvm"); got != "debian-13-kvm" { validID := GetImages()[0].ID
t.Fatalf("localImageID(valid) = %q", got) if got := filepath.Base(ImagePath(validID)); got != validID+".qcow2" {
t.Fatalf("ImagePath(%q) basename = %q", validID, got)
} }
} }
backend/internal/kvm/templates.go
+5 -11
View File
@@ -4,7 +4,6 @@ import (
"os" "os"
"path/filepath" "path/filepath"
"runtime" "runtime"
"strings"
"clicd/internal/config" "clicd/internal/config"
) )
@@ -193,10 +192,14 @@ func CacheDir() string {
func ImagePath(id string) string { func ImagePath(id string) string {
img := FindImage(id) img := FindImage(id)
ext := ".qcow2" ext := ".qcow2"
safeID := "__invalid_image_id__"
if img != nil {
safeID = img.ID
}
if img != nil && img.Distro == "windows" { if img != nil && img.Distro == "windows" {
ext = ".iso" ext = ".iso"
} }
fileName := localImageID(id) + ext fileName := safeID + ext
for _, pool := range config.StoragePoolsForContent(config.StorageContentImages) { for _, pool := range config.StoragePoolsForContent(config.StorageContentImages) {
candidate := filepath.Join(pool.Path, "images", "kvm", fileName) candidate := filepath.Join(pool.Path, "images", "kvm", fileName)
if info, err := os.Stat(candidate); err == nil && !info.IsDir() { if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
@@ -210,15 +213,6 @@ func ImagePath(id string) string {
return filepath.Join(CacheDir(), fileName) return filepath.Join(CacheDir(), fileName)
} }
func localImageID(id string) string {
trimmed := strings.TrimSpace(id)
local := filepath.Base(trimmed)
if trimmed == "" || local == "." || local == ".." || local != trimmed || strings.ContainsAny(trimmed, `/\\`) {
return "__invalid_image_id__"
}
return local
}
// IsWindowsImage returns true if the image distro is "windows". // IsWindowsImage returns true if the image distro is "windows".
func IsWindowsImage(id string) bool { func IsWindowsImage(id string) bool {
img := FindImage(id) img := FindImage(id)
backend/internal/lxc/lxc.go
+1 -1
View File
@@ -708,7 +708,7 @@ func (m *Manager) applyLANIPv4Config(lxcName string, cfg ContainerConfig) (strin
values["lxc.net.0.ipv4.gateway"] = strings.TrimSpace(cfg.LANIPv4Gateway) values["lxc.net.0.ipv4.gateway"] = strings.TrimSpace(cfg.LANIPv4Gateway)
} }
seen := map[string]bool{} seen := map[string]bool{}
next := make([]string, 0, len(lines)+len(values)) next := make([]string, 0, len(lines))
for _, line := range lines { for _, line := range lines {
trimmed := strings.TrimSpace(line) trimmed := strings.TrimSpace(line)
if !cfg.WantsLANStaticIPv4() && (strings.HasPrefix(trimmed, "lxc.net.0.ipv4.address") || strings.HasPrefix(trimmed, "lxc.net.0.ipv4.gateway")) { if !cfg.WantsLANStaticIPv4() && (strings.HasPrefix(trimmed, "lxc.net.0.ipv4.address") || strings.HasPrefix(trimmed, "lxc.net.0.ipv4.gateway")) {