Need to add 'quotes' around <password> (and maybe other) parameters in templates; also, formal character escaping

Cacti templates by default do not 'quote' nor does Cacti seem to have an
escaping function, for user-supplied inputs (such as hostnames, ports,
passwords, etc).

 

Forgive me if this has already been discussed. A search for "quote" and
"password" unfortunately comes up with a very large number of results, all
of them at first glance unrelated.

 

Also, yes, I realise that whoever runs Cacti ought to be somewhat
trustworthy, but the overall idea of not letting user input be passed
through to a command shell un-sanitised or un-escaped I think is still
valid, as it bit me on the "contains a single quote" example below.

 

What steps will reproduce the problem?

1. Add any template which requires a password, to some monitored Device

2. Put in a password which contains a character to which the shell is
sensitive, e.g. a double quote " or a single quote ' or an exclamation point
! etc

3. Watch the fireworks in the log file :-)

 

Proposed Solution: In all templates which take <password> parameters, and
likely any other parameters where the user could either foolishly or
legitimately (as in the case of the passwords) enter any kind of data which
could be eaten by the shell, put single quotes around the <parameters>, such
as '<password>'.

 

Further consideration: Probably need to use an escaping library to avoid
foolish or malicious injection attacks which could cause very unexpected
shell behaviour, such as:

 

  password = ;echo Hi Mom >/tmp/Mom;echo

 

Which a few minutes later gives us:

 

  # cat /tmp/Mom

  Hi Mom

 

:-)

or I suppose that should be  L

 

 

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2