diff mbox series

[1/1] image-accounts: directly pass arguments to openssl instead of shell

Message ID 20250612155610.473593-1-felix.moessbauer@siemens.com
State Under Review
Headers show
Series [1/1] image-accounts: directly pass arguments to openssl instead of shell | expand

Commit Message

MOESSBAUER, Felix June 12, 2025, 3:56 p.m. UTC 
When hashing the password, the whole openssl command was passed as a
shell string instead of directly passing the individual arguments as-is.
Further, the arguments were not shell escaped. By that, passwords
containing a string were split into two individual arguments, breaking
the command (or silently set a different password if the remainder
itself was a valid argument).

We fix this by passing the arguments as-is (as list) to bb.process.run.

Fixes: 6144daf9 ("image-account-extension: Avoid deprecated crypt...")
Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes/image-account-extension.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
index 3c461b1a..25288e76 100644
--- a/meta/classes/image-account-extension.bbclass
+++ b/meta/classes/image-account-extension.bbclass
@@ -133,7 +133,7 @@  def image_create_users(d: "DataSmart") -> None:
                 source_date_epoch = d.getVar("SOURCE_DATE_EPOCH")
                 command.append("-e")
                 salt = hashlib.sha256("{}\n".format(source_date_epoch).encode()).hexdigest()[0:15]
-                password = bb.process.run('openssl passwd -6 --salt {} {}'.format(salt, password))[0].strip()
+                password = bb.process.run(['openssl', 'passwd', '-6', '--salt', salt, password])[0].strip()
 
             else:
                 command.append("-e")