84 lines
2.1 KiB
Diff
84 lines
2.1 KiB
Diff
|
Index: src/libs/zbxsysinfo/sysinfo.c
|
||
|
|
===================================================================
|
||
|
|
--- src/libs/zbxsysinfo/sysinfo.c (revision 40348)
|
||
|
|
+++ src/libs/zbxsysinfo/sysinfo.c (working copy)
|
||
|
|
@@ -427,13 +427,49 @@
|
||
|
|
test_aliases();
|
||
|
|
}
|
||
|
|
|
||
|
|
+static int zbx_check_user_parameter(const char *param, char *error, int max_error_len)
|
||
|
|
+{
|
||
|
|
+ const char suppressed_chars[] = "\\'\"`*?[]{}~$!&;()<>|#@\n", *c;
|
||
|
|
+ char *buf = NULL;
|
||
|
|
+ size_t buf_alloc = 128, buf_offset = 0;
|
||
|
|
+
|
||
|
|
+ if (0 != CONFIG_UNSAFE_USER_PARAMETERS)
|
||
|
|
+ return SUCCEED;
|
||
|
|
+
|
||
|
|
+ for (c = suppressed_chars; '\0' != *c; c++)
|
||
|
|
+ {
|
||
|
|
+ if (NULL == strchr(param, *c))
|
||
|
|
+ continue;
|
||
|
|
+
|
||
|
|
+ buf = zbx_malloc(buf, buf_alloc);
|
||
|
|
+
|
||
|
|
+ for (c = suppressed_chars; '\0' != *c; c++)
|
||
|
|
+ {
|
||
|
|
+ if (c != suppressed_chars)
|
||
|
|
+ zbx_strcpy_alloc(&buf, &buf_alloc, &buf_offset, ", ");
|
||
|
|
+
|
||
|
|
+ if (0 != isprint(*c))
|
||
|
|
+ zbx_chrcpy_alloc(&buf, &buf_alloc, &buf_offset, *c);
|
||
|
|
+ else
|
||
|
|
+ zbx_snprintf_alloc(&buf, &buf_alloc, &buf_offset, "0x%02x", *c);
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ zbx_snprintf(error, max_error_len, "special characters \"%s\" are not allowed in the parameters", buf);
|
||
|
|
+
|
||
|
|
+ zbx_free(buf);
|
||
|
|
+
|
||
|
|
+ return FAIL;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ return SUCCEED;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
static int replace_param(const char *cmd, const char *param, char *out, int outlen, char *error, int max_error_len)
|
||
|
|
{
|
||
|
|
int ret = SUCCEED;
|
||
|
|
char buf[MAX_STRING_LEN];
|
||
|
|
char command[MAX_STRING_LEN];
|
||
|
|
char *pl, *pr;
|
||
|
|
- const char suppressed_chars[] = "\\'\"`*?[]{}~$!&;()<>|#@", *c;
|
||
|
|
|
||
|
|
assert(out);
|
||
|
|
|
||
|
|
@@ -465,25 +501,10 @@
|
||
|
|
{
|
||
|
|
get_param(param, (int)(pr[1] - '0'), buf, sizeof(buf));
|
||
|
|
|
||
|
|
- if (0 == CONFIG_UNSAFE_USER_PARAMETERS)
|
||
|
|
- {
|
||
|
|
- for (c = suppressed_chars; '\0' != *c; c++)
|
||
|
|
- {
|
||
|
|
- if (NULL != strchr(buf, *c))
|
||
|
|
- {
|
||
|
|
- zbx_snprintf(error, max_error_len, "Special characters '%s'"
|
||
|
|
- " are not allowed in the parameters",
|
||
|
|
- suppressed_chars);
|
||
|
|
- ret = FAIL;
|
||
|
|
- break;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ if (SUCCEED != (ret = zbx_check_user_parameter(buf, error, max_error_len)))
|
||
|
|
+ break;
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (FAIL == ret)
|
||
|
|
- break;
|
||
|
|
-
|
||
|
|
zbx_strlcat(out, buf, outlen);
|
||
|
|
outlen -= MIN((int)strlen(buf), (int)outlen);
|
||
|
|
|