Jian Qiu c053206af9 fix(hostimage): harden nbd export against command injection (#25531) ...

The nbd export endpoints interpolated the request disk_id into
shell commands (sh -c with the joined qemu-nbd command line, and
ps|grep for the process check), so a crafted disk_id could execute
arbitrary commands as root on the host image service.

- Require the disk_id to be a plain UUID in both export and close
  endpoints
- Run qemu-nbd with argv instead of sh -c
- Check the export process via its pid file and kill -0 instead of
  shell pipelines
- Add unit tests for the validation and the process check

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 23:47:31 +08:00

..

doc.go

update copyright headers of all source

2019-03-29 14:47:48 +08:00

host_image_service.go

fix(region,host): optimize snapshot delete (#25441)

2026-08-27 16:22:54 +08:00

nbd_test.go

fix(hostimage): harden nbd export against command injection (#25531)

2026-09-03 23:47:31 +08:00

nbd.go

fix(hostimage): harden nbd export against command injection (#25531)

2026-09-03 23:47:31 +08:00