gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

shared/validate: Reject compression algorithm arguments

Browse Source 
This addresses CVE-2026-48755

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This commit is contained in:
Stéphane Graber 2026-06-22 14:12:43 -04:00
parent cbefa31ae0
commit 873a032a46
No known key found for this signature in database
GPG Key ID: C638974D64792D67
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
shared/validate/validate.go
View File

@ -640,6 +640,14 @@ func IsCompressionAlgorithm(value string) error {
return errors.New("Invalid compressor provided")
}
// Only allow known-safe arguments (compression levels) to avoid argument injection.
allowedArgs := []string{"-1", "-2", "-3", "-4", "-5", "-6", "-7", "-8", "-9", "--rsyncable"}
for _, arg := range fields[1:] {
if !slices.Contains(allowedArgs, arg) {
return fmt.Errorf("Compression algorithm argument %q isn't allowed", arg)
}
}
// Check that we're dealing with a supported option.
if !slices.Contains([]string{
"bzip2",