-
Notifications
You must be signed in to change notification settings - Fork 1.3k
SSH key pairs are very buggy #12925
Copy link
Copy link
Open
Labels
Description
problem
Having the ssh key pairs being identified by their name leads to a lot of weird issues.
- The key pair validator allows commas(and other special characters like an ampersand) in the key pair name.
- The
deployVirtualMachinecommandkeypairsparameter isn't escaped, this breaks on key pairs containing commas. - The
deployVirtualMachinecommandkeypairworks with commas - The UI breaks when a key pair contains commas, below is a single key containing a bunch of commas

- If the API consumer assumes the key pair name is safe and validated by cloudstack it cloud lead to a command injection(but it requires a lot of wrong assumptions)
versions
CloudStack 4.22.0.0
The steps to reproduce the bug
You can use the UI to observe most of the issues:
- Create a new key pair with a comma in the name eg.
test, test - Try creating a new instance with said key
What to do about it?
- Add a new
keypairIdarray parameter to all the endpoint which access key pair name. - Mark the
keypairandkeypairsparameters deprecated.
Reactions are currently unavailable