mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
764cbb3c43
Each was checked with git grep across every tracked file (templates, JS, shell, unit files and the extensionless console daemons) and for dynamic use (URL names, template names, registries): - vrtManager: host_is_up, is_kvm_supported, get_emulators, get_file_extensions, both get_network_forward, get_snapshots, get_storages_images, get_os_type, get_host_arch, the get_pretty_* trio and, in util, is_kvm_available, randomMAC, get_max_vcpus, compareMAC, pretty_mem, pretty_bytes and validate_uuid; with them the port constants only host_is_up read. Some were reached only by their tests, which go too. - The flavor edit page: nothing linked to it; flavors are created and deleted on the Flavors page and edited through the API. - computes.validate_name, UserForm.identity_has_errors, the has_perm template tag, the ALLOW_EMPTY_PASSWORD setting nothing reads, hidePleaseWaitDialog, default_app_config (ignored since Django 4.1) and the Python < 3.6 lines of secret_generator.py.
48 lines
1.7 KiB
Python
48 lines
1.7 KiB
Python
"""A compute's hostname and login go unquoted into libvirt connection URIs
|
|
and an ssh command line; they are validated so neither can inject a URI
|
|
parameter (e.g. ?command=, ?no_verify=) or an ssh option."""
|
|
|
|
import unittest
|
|
|
|
from django.core.exceptions import ValidationError
|
|
|
|
from computes.validators import validate_hostname, validate_login
|
|
|
|
|
|
class HostnameValidatorTestCase(unittest.TestCase):
|
|
def test_accepts_ipv4_and_host_names(self):
|
|
for value in ("192.0.2.10", "localhost", "host.example.com", "a-b.example.", "host1"):
|
|
with self.subTest(value=value):
|
|
validate_hostname(value)
|
|
|
|
def test_rejects_uri_and_option_injection(self):
|
|
for value in (
|
|
"-x",
|
|
"a b;c",
|
|
"host:2222",
|
|
"192.0.2.1/system?command=/evil.sh&a=",
|
|
"host/system?no_verify=1",
|
|
"qemu+ssh://host/system",
|
|
"2001:db8::1",
|
|
"",
|
|
"host name",
|
|
):
|
|
with self.subTest(value=value):
|
|
with self.assertRaises(ValidationError):
|
|
validate_hostname(value)
|
|
|
|
|
|
class LoginValidatorTestCase(unittest.TestCase):
|
|
def test_accepts_plain_logins_and_empty(self):
|
|
# empty: TCP falls back to server auth, the socket transport ignores it
|
|
for value in ("", "root", "libvirt.user", "user-1", "_svc"):
|
|
with self.subTest(value=value):
|
|
validate_login(value)
|
|
|
|
def test_rejects_option_and_delimiter_injection(self):
|
|
for value in ("-oProxyCommand=x", "u@realm", "a/b", "a b", "a\\b", "a%b"):
|
|
with self.subTest(value=value):
|
|
with self.assertRaises(ValidationError):
|
|
validate_login(value)
|
|
|
|
|