Description of problem: It is possible to create an environment variable with a null value. Both Ruby and Python reject environment variables with embedded nulls when spawning a process. Version-Release number of selected component (if applicable): How reproducible: Use API to create environment variable with embedded null Steps to Reproduce: 1. 2. 3. Actual results: oo-trap-user or oo-su fail to allow user to log in. Expected results: API should reject attempts to set these environment variables Additional info:
An example of an env var value with an embedded null is --> TEST\000TEST
https://github.com/openshift/origin-server/pull/5384
Commit pushed to master at https://github.com/openshift/origin-server https://github.com/openshift/origin-server/commit/4e55d6763e7f16b4036d80c3e35ca2c557e09de4 Bug 1094541 - check for null values
Verified this bug on devenv_4775 --set value to \\000 via rhc 1) # rhc app create app1 diy --no-git -e foo=\\000 Using diy-0.1 (Do-It-Yourself 0.1) for 'diy' Application Options ------------------- Domain: zqd Cartridges: diy-0.1 Gear Size: default Scaling: no Environment Variables: foo=\000 Creating application 'app1' ... Value cannot contain null characters. 2) rhc env-set -a php1 foo=\\000 Setting environment variable(s) ... Value cannot contain null characters. --Set value to \\000 via restapi 1)curl -k -H 'Accept: application/xml' --user $user:pass https://localhost/broker/rest/domains/zqd/applications/php1/environment_variables -d 'environment_variables[][name]=foo' -d 'environment_variables[][value]=\\00000' -X POST Value cannot contain null characters.</text> <exit-code>190</exit-code> 2) update a value to \\000 curl -k -H 'Accept: application/xml' --user zzhao:redhat https://localhost/broker/rest/application/536b4075798389700c00001e/environment-variable/foo -d value=\\000 -X PUT <severity>error</severity> <text>Value cannot contain null characters.</text> <exit-code>190</exit-code> 3) create app with env value equals \\000 curl -k -s -H "Content-Type: application/json" -u $user:pass https://localhost/broker/rest/domains/zqd/applications -X POST -d '{"name":"app2","cartridge":{"url":"https://raw.github.com/zhaozhanqi/phpv2/master/metadata/manifest.yml"},"environment_variables":[{"name":"FOO", "value":"\\000"}]}' |python -m json.tool "messages": [ { "exit_code": 190, "field": "environment_variables", "index": null, "severity": "error", "text": "Value cannot contain null characters." } ],