Bug 1197580
| Summary: | libvirt should escape possible invalid characters. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Hao Liu <hliu> |
| Component: | libvirt | Assignee: | Pavel Hrdina <phrdina> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.1 | CC: | dyuan, fjin, hliu, lhuang, mzhan, phrdina, rbalakri |
| Target Milestone: | rc | ||
| Target Release: | 7.2 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-1.2.16-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 06:18:34 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream patch proposed: https://www.redhat.com/archives/libvir-list/2015-May/msg00110.html Upstream commit:
commit d091518b353d49b772a1e68acbe0fd0be76e33d6
Author: Pavel Hrdina <phrdina>
Date: Tue May 5 16:52:46 2015 +0200
XML: escape strings where we should do it
There is a lot of places, were it's pretty easy for user to enter some
characters that we need to escape to create a valid XML description.
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1197580
Signed-off-by: Pavel Hrdina <phrdina>
v1.2.15-63-gd091518
Steps:
1.Define a vm with the attributes as below:
...
<graphics type='vnc' port='-1' autoport='yes' socket='<>'>
</graphics>
...
2.Dump the xml:
# virsh dumpxml test
...
<graphics type='vnc' socket='<>'/>
...
3.Try to edit the xml:
# virsh edit test
error: (domain_definition):125: Unescaped '<' not allowed in attributes values
<graphics type='vnc' socket='<>'/>
---------------------------------^
Failed. Try again? [y,n,i,f,?]:
The issue still exists with graphics->socket.
Hi, you're right, I've missed that one. (In reply to Pavel Hrdina from comment #5) > Hi, you're right, I've missed that one. Hello, Pavel Will you include the fix in this bug? Or we can just verify it with the current fix now, and note the missing part in the comment. Hi, there is a patch upstream, that fixes it, but it's not critical and we will not include it in RHEL-7.2. Please create a new bug against RHEL-7.3 so we can track this issue. Thanks Test on build libvirt-1.2.17-13.el7.x86_64:
Domain xml:
1)Define a guest with the following settings:
# cat escape.xml
<domain type='kvm'>
<name>test4<</name>
<title>A short description -<> title - of the domain</title>
--
<cpu mode='custom' match='exact'>
<model vendor_id='uthedjdjdj<>'>IvyBridge<></model>
<vendor>Intel<></vendor>
</cpu>
--
<devices>
<emulator>/usr/libexec/dd</qemu-kvm</emulator>
--
<interface type='network'>
<rom bar='on' file='/etc/fake/boot<>.bin'/>
--
<serial type="udp">
<source mode="bind" host="<ddd0.0.0.0>" service="<2445>"/>
<source mode="connect" host="<ddd0.0.0.0>" service="<2445>"/>
--
<serial type="tcp">
<source mode="bind" host="<ddd0.0.0.0>" service="<2445>"/>
--
<serial type="tcp">
<source mode="connect" host="<ddd0.0.0.0>" service="<2445>"/>
--
<serial type="nmdm">
<source master="/dev/n<mdm0>A" slave="/dev/nm<dm0>B"/>
--
</devices>
<seclabel type='dynamic' model='selinux<>' relabel='yes'/>
# virsh define escape.xml
Domain test4< defined from escape.xml
2)Dumpxml, the special characters are escaped correctly:
# virsh dumpxml 'test4<'
<name>test4<</name>
<title>A short description -<> title - of the domain</title>
<model fallback='allow' vendor_id='uthedjdjdj<>'>IvyBridge<></model>
<vendor>Intel<></vendor>
<emulator>/usr/libexec/dd</qemu-kvm</emulator>
<rom bar='on' file='/etc/fake/boot<>.bin'/>
<source mode='bind' host='<ddd0.0.0.0>' service='<2445>'/>
<source mode='connect' host='<ddd0.0.0.0>' service='<2445>'/>
<source mode='bind' host='<ddd0.0.0.0>' service='<2445>'/>
<source mode='connect' host='<ddd0.0.0.0>' service='<2445>'/>
<source master='/dev/n<mdm0>A' slave='/dev/nm<dm0>B'/>
<seclabel type='dynamic' model='selinux<>' relabel='yes'/>
3)Try to edit the guest xml, edit succeed:
# virsh edit 'test4<'
Domain test4< XML configuration edited.
4)Define a guest xml with the following settings:
# cat escape.xml |grep spiceport -a3
<serial type="spiceport">
<source channel="org.qemu.console.s<erial.0"/>
# virsh define escape.xml
error: Failed to define domain from escape.xml
error: invalid argument: Invalid character in source channel for char device
Network xml:
1)Define a network with the following settings:
# cat vepa-network.xml
<network>
<dns>
<txt name="example"" value="example value"" />
<srv service='name' protocol='tcp' domain='test-domain-name"' target='."' port='1024' priority='10' weight='10'/>
<host ip='192.168.122.2'>
<hostname>myh"ost</hostname>
<hostname>myh"ostalias</hostname>
# virsh net-define vepa-network.xml
Network vepa-net defined from vepa-network.xml
2)Dumpxml, the special characters are escaped correctly:
# virsh net-dumpxml vepa-net
...
<txt name='example"' value='example value"'/>
<srv service='name' protocol='tcp' domain='test-domain-name"' target='."' port='1024' priority='10' weight='10'/>
<hostname>myh"ost</hostname>
<hostname>myh"ostalias</hostname>
...
3)Try to edit the network xml, edit succeed:
# virsh net-edit vepa-net
Network vepa-net XML configuration edited.
(In reply to Pavel Hrdina from comment #7) > Hi, there is a patch upstream, that fixes it, but it's not critical and we > will not include it in RHEL-7.2. Please create a new bug against RHEL-7.3 > so we can track this issue. > > Thanks Comment 8 tested part of the places that have been escaped correctly. Move this bug to verified. And created new bug 1270427 for the missing two places that need to escape: /domain/devices/disk/driver[@name] /domain/devices/graphics[@socket] Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2202.html |
Description: libvirt should escape possible invalid characters. How producible 100% Version: libvirt-1.2.8-16.el7.x86_64 Steps 1. Define a VM with some invalid characters and check the defined XML. # cat vm.xml <domain type='kvm'> <name>test</name> <title><></title> <memory unit='KiB'>1048576</memory> <os> <type arch='x86_64' machine='pc-i440fx-rhel7.1.0'>hvm</type> </os> <cpu mode='custom' match='exact'> <model fallback='allow'><></model> </cpu> <devices> <graphics type='vnc' socket='/<>'> </graphics> </devices> </domain> # virsh define vm.xml Domain test defined from vm.xml # virsh dumpxml test ... <title><></title> ... <cpu mode='custom' match='exact'> <model fallback='allow'><></model> </cpu> ... <graphics type='vnc' socket='/<>'/> ... 2. Now if we try to edit the configuration # virsh edit test error: (domain_definition):12: StartTag: invalid element name <model fallback='allow'><></model> -----------------------------^ Failed. Try again? [y,n,f,?]: 3. Same thing exists in but to confined to following paths: "/domain/devices/hostdev/rom/file" "/domain/devices/source/seclabel/model" Expected results: Either the saved XML should be escaped correctly, or it should be failed out at the defining stage.