Fixes SSH injection threat in 3PAR driver

The setqos ssh command was not built up correctly when the following
patch https://review.openstack.org/#/c/37697/ landed for cleaning up
the SSH calls from injection attacks in the 3PAR driver.

The command was in the following format causing the injection threat
due to the spaces in the second item in the list:
['setqos', '-io 5000 -bw 500M vvset:vvs-JOHB2Oj0QJ2UaWatwbe7Bg']
When it should actually be in the following format:
['setqos', '-io', '5000', '-bw', '500M', 'vvset:vvs-JOHB2Oj0QJ2UaWatwbe7Bg']

This patch fixes an append vs. extend that was introduced in patch
https://review.openstack.org/#/c/42241

Also fixes: bug 1212884

Change-Id: I28f84acd02397ee0d433a666375737145904d67e

diff --git a/cinder/volume/drivers/san/hp/hp_3par_common.py b/cinder/volume/drivers/san/hp/hp_3par_common.py
index 1a7b7f95cfaebe9fc9688c131f3292d5753d7a2f..20235800b2c7697b6f9533d4c60d9213ecbbe89d 100644 (file)
--- a/cinder/volume/drivers/san/hp/hp_3par_common.py
+++ b/cinder/volume/drivers/san/hp/hp_3par_common.py
@@ -623,7 +623,7 @@ exit
         if max_io is not None:
             cmd.extend(['-io', '%s' % max_io])
         if max_bw is not None:
-            cmd.append(['-bw', '%sM' % max_bw])
+            cmd.extend(['-bw', '%sM' % max_bw])
         cmd.append('vvset:' + vvs_name)
         self._cli_run(cmd)