1307034 – atomic fails for some characters in parameters

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1307034 - atomic fails for some characters in parameters

Summary: atomic fails for some characters in parameters

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	atomic
Sub Component:
Version:	7.2
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Lokesh Mandvekar
QA Contact:	atomic-bugs@redhat.com
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2016-02-12 14:17 UTC by Jan Pazdziora
Modified:	2016-06-23 16:21 UTC (History)
CC List:	3 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-06-23 16:21:19 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2016:1273	0	normal	SHIPPED_LIVE	atomic bug fix and enhancement update	2016-06-23 20:13:11 UTC

Description Jan Pazdziora 2016-02-12 14:17:07 UTC

Description of problem:

When non-alphanum characters are used as parameters to atomic command for example when passwords are passed in, atomic might fail.

Version-Release number of selected component (if applicable):

atomic-1.6-6.gitca1e384.el7.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. Dockerfile:

FROM rhel7
ADD install.sh /bin/install.sh
RUN chmod +x /bin/install.sh
LABEL INSTALL 'docker run --name ${NAME} -e NAME=${NAME} -e IMAGE=${IMAGE} ${IMAGE} /bin/install.sh'

2. install.sh:

#!/bin/bash
for i in "$@" ; do
	printf '%q\n' "$i" >> /run/install-options
done
cat /run/install-options

3. Build image: docker build -t escapes .
4. Run: atomic install escapes --test 'asdf asdf'
5. Run: atomic install escapes --test 'asdf&asdf'
6. Run: atomic install escapes --test ježek
7. Run: atomic install escapes --test 'asdf"asdf'
8. Run: atomic install escapes --test "asdf'asdf"

Actual results:

# atomic install escapes --test 'asdf asdf'
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'asdf asdf'
--test
asdf\ asdf
# atomic install escapes --test 'asdf&asdf'
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'asdf&asdf'
--test
asdf\&asdf
# atomic install escapes --test ježek
'ascii' codec can't decode byte 0xc5 in position 3: ordinal not in range(128)
# atomic install escapes --test 'asdf"asdf'
/bin/sh: -c: line 0: unexpected EOF while looking for matching `''
/bin/sh: -c: line 1: syntax error: unexpected end of file
# atomic install escapes --test "asdf'asdf"
/bin/sh: -c: line 0: unexpected EOF while looking for matching `''
/bin/sh: -c: line 1: syntax error: unexpected end of file

Expected results:

# atomic install escapes --test 'asdf asdf'
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'asdf asdf'
--test
asdf\ asdf
# atomic install escapes --test 'asdf&asdf'
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'asdf&asdf'
--test
asdf\&asdf
# atomic install escapes --test ježek
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'ježek'
--test
ježek
# atomic install escapes --test 'asdf"asdf'
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'asdf"asdf'
--test
asdf\"asdf
# atomic install escapes --test "asdf'asdf"
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test asdf\'asdf
--test
asdf\'asdf

and no error reported.

Additional info:

Comment 3 Daniel Walsh 2016-02-22 19:40:27 UTC

Jan is this still a problem with atomic-1.8?

Comment 4 Jan Pazdziora 2016-02-23 07:49:13 UTC

(In reply to Daniel Walsh from comment #3)
> Jan is this still a problem with atomic-1.8?

Yes.

I've tested with atomic-1.8-3.gitcc5997a.fc23.x86_64.

The non-ASCII issue has been fixed:

# atomic install escapes --test ježek
docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes /bin/install.sh --test 'ježek'
--test
$'je\305\276ek'

But the quote characters handling is still broken:

# atomic install escapes --test 'asdf"asdf'
/bin/sh: -c: line 0: unexpected EOF while looking for matching `''
/bin/sh: -c: line 1: syntax error: unexpected end of file
# atomic install escapes --test "asdf'asdf"
/bin/sh: -c: line 0: unexpected EOF while looking for matching `''
/bin/sh: -c: line 1: syntax error: unexpected end of file

Comment 5 Jan Pazdziora 2016-04-01 12:33:06 UTC

(In reply to Jan Pazdziora from comment #4)
> (In reply to Daniel Walsh from comment #3)
> > Jan is this still a problem with atomic-1.8?
> 
> Yes.
> 
> I've tested with atomic-1.8-3.gitcc5997a.fc23.x86_64.
> 
> The non-ASCII issue has been fixed:
> 
> # atomic install escapes --test ježek
> docker run --rm --name escapes -e NAME=escapes -e IMAGE=escapes escapes
> /bin/install.sh --test 'ježek'
> --test
> $'je\305\276ek'

This fix was lost again in atomic 1.9: bug 1323165 comment 2.

Comment 6 Daniel Walsh 2016-06-03 19:55:28 UTC

Fixed in atomic-1.10

Comment 7 Jan Pazdziora 2016-06-07 17:05:08 UTC

I confirm that with python-docker-py-1.7.2-1.el7.noarch and atomic-1.10.3-2.el7.x86_64, installed, all cases from comment 0 pass.

The

atomic install escapes --test ježek

produces

$'je\305\276ek'

but that is also valid.

Comment 9 Alex Jia 2016-06-12 10:57:44 UTC

All of testing are passed in Comment 0, so move the bug to VERIFIED status. 

[cloud-user@atomic-host-001 ~]$ cat /etc/redhat-release 
Red Hat Enterprise Linux Atomic Host release 7.2


[cloud-user@atomic-host-001 ~]$ sudo atomic host status
  TIMESTAMP (UTC)         VERSION     ID             OSNAME               REFSPEC                                                   
* 2016-06-06 18:12:07     7.2.5       4bf265cf86     rhel-atomic-host     rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
  2016-05-06 05:57:30     7.2.4       b060975ce3     rhel-atomic-host     rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard


[cloud-user@atomic-host-001 ~]$ rpm -q atomic docker python-docker-py
atomic-1.10.3-1.el7.x86_64
docker-1.10.3-31.el7.x86_64
python-docker-py-1.7.2-1.el7.noarch

Comment 11 errata-xmlrpc 2016-06-23 16:21:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1273

Note You need to log in before you can comment on or make changes to this bug.