]> review.fuel-infra Code Review - openstack-build/cinder-build.git/commit
Fix SSH injection threat in 3PAR driver
authorKurt Martin <kurt.f.martin@hp.com>
Thu, 15 Aug 2013 23:22:31 +0000 (16:22 -0700)
committerKurt Martin <kurt.f.martin@hp.com>
Thu, 15 Aug 2013 23:22:31 +0000 (16:22 -0700)
commite8acc504faccbf815b53d2c39cdc6d858ba03da3
treef4909ada3c10f165e910097c1550b6d776e3b183
parentb0018248b07a6d72b985fb480b5304e7761e977f
Fix SSH injection threat in 3PAR driver

The setqos ssh command was not built up correctly when the following
patch https://review.openstack.org/#/c/37697/ landed for cleaning up
the SSH calls from injection attacks in the 3PAR driver.

The command was in the following format causing the injection threat
due to the spaces in the second item in the list:
['setqos', '-io 5000 -bw 500M vvset:vvs-JOHB2Oj0QJ2UaWatwbe7Bg']
When it should actually be in the following format:
['setqos', '-io', '5000', '-bw', '500M', 'vvset:vvs-JOHB2Oj0QJ2UaWatwbe7Bg']

Change-Id: I69ed8dbca3af3ba56220891411b63331c1935373
Fixes: bug 1212884
cinder/volume/drivers/san/hp/hp_3par_common.py