Bug 2148433

This change done in Satellite 6.12 seems to be creating the issue i.e. https://github.com/theforeman/foreman/commit/767fea2621952fc0cf14120b723614f58e1bd818 

Specifically the shellescape on the filename here in https://github.com/theforeman/foreman/blob/develop/app/services/foreman/renderer/scope/macros/base.rb#L116 

# foreman-rake console
Loading production environment (Rails 6.0.4.7)
~~~~~~~
irb(main):002:0> filename = '/etc/sysconfig/network-scripts/ifcfg-$sanitized_real'
=> "/etc/sysconfig/network-scripts/ifcfg-$sanitized_real"

irb(main):003:0> filename.shellescape
=> "/etc/sysconfig/network-scripts/ifcfg-\\$sanitized_real"



6.11 does this:

cat << EOF > /etc/sysconfig/network-scripts/ifcfg-$sanitized_real
BOOTPROTO="dhcp"
DOMAIN="example.com"
DEVICE=$real
HWADDR="00:50:56:b4:14:44"
ONBOOT=yes
PEERDNS=yes
PEERROUTES=yes
DEFROUTE=yes
MTU=1500
EOF


But due to the change in 6.12 code, It does this:

cat << EOF-cd4e31fd > /etc/sysconfig/network-scripts/ifcfg-\$sanitized_real
BOOTPROTO="dhcp"
DOMAIN="example.com"
DEVICE=$real
HWADDR="00:50:56:b4:4f:c6"
ONBOOT=yes
PEERDNS=yes
PEERROUTES=yes
DEFROUTE=yes
MTU=1500
EOF-cd4e31fd



And following fixes the escaping issue i.e. 

diff --git a/app/services/foreman/renderer/scope/macros/base.rb b/app/services/foreman/renderer/scope/macros/base.rb
index 9b7304a..ebdde11 100644
--- a/app/services/foreman/renderer/scope/macros/base.rb
+++ b/app/services/foreman/renderer/scope/macros/base.rb
             example "save_to_file('/etc/motd', \"hello\\nworld\\n\") # => 'cat << EOF-0e4f089a > /etc/motd\\nhello\\nworld\\nEOF-0e4f089a'"
           def save_to_file(filename, content, verbatim: false)
-            filename = filename.shellescape
             delimiter = 'EOF-' + Digest::SHA512.hexdigest(filename)[0..7]
             if content.empty?
               "cp /dev/null #{filename}"

I am not sure if we absolutely have to use shellescape here on the filename or not. But if yes, Then The resolution perhaps will become more complicated.

It would be good if someone from the Engg team can share their opinion here as well.

(In reply to Sayan Das from comment #3)
> I am not sure if we absolutely have to use shellescape here on the filename
> or not. But if yes, Then The resolution perhaps will become more complicated.
> 
> It would be good if someone from the Engg team can share their opinion here
> as well.

@sayan, after the changes it's working as expected. can you share the steps to apply the fix in the bug, so that I can share the same with the customer.

Hi Satyajit.

This is what I did.

# cd /usr/share/foreman

# git init .;git add .;git commit -m 'original state'

--> Create the file 2148433.patch manually here with the following content.

diff --git a/app/services/foreman/renderer/scope/macros/base.rb b/app/services/foreman/renderer/scope/macros/base.rb
index 9b7304a..ebdde11 100644
--- a/app/services/foreman/renderer/scope/macros/base.rb
+++ b/app/services/foreman/renderer/scope/macros/base.rb
@@ -113,7 +113,6 @@ module Foreman
             example "save_to_file('/etc/motd', \"hello\\nworld\\n\") # => 'cat << EOF-0e4f089a > /etc/motd\\nhello\\nworld\\nEOF-0e4f089a'"
           end
           def save_to_file(filename, content, verbatim: false)
-            filename = filename.shellescape
             delimiter = 'EOF-' + Digest::SHA512.hexdigest(filename)[0..7]
             if content.empty?
               "cp /dev/null #{filename}"
               
               
--> Apply the patch:

# patch -p1 < 2148433.patch

# systemctl restart httpd foreman

# sleep 20 && hammer ping


and then simply rebuild the host or test a new build.

Connecting redmine issue https://projects.theforeman.org/issues/35792 from this bug.

Moving to modified as upstream PR have been merged and cherry-picked into the 3.5 upstream branch: https://github.com/theforeman/foreman/commit/9c56caa860cb9c641400184da9859839a9ea780e

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.13 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2097