@@ -3,7 +3,9 @@ package node
3
3
import (
4
4
"fmt"
5
5
"net"
6
+ "regexp"
6
7
"sort"
8
+ //"strconv"
7
9
"strings"
8
10
9
11
"k8s.io/apimachinery/pkg/util/sets"
@@ -17,6 +19,21 @@ import (
17
19
"github.com/openshift/origin/pkg/network"
18
20
)
19
21
22
+ // safeArgRegexp matches only characters that are known safe. DO NOT add to this list
23
+ // without fully considering whether that new character can be used to break shell escaping
24
+ // rules.
25
+ var safeArgRegexp = regexp .MustCompile (`^[\da-zA-Z\-=_\.,/\:]+$` )
26
+
27
+ // shellEscapeArg quotes an argument if it contains characters that my cause a shell
28
+ // interpreter to split the single argument into multiple.
29
+ func shellEscapeArg (s string ) string {
30
+ if safeArgRegexp .MatchString (s ) {
31
+ return s
32
+ }
33
+ //return strconv.Quote(s)
34
+ return fmt .Sprintf ("\" %v\" " , s )
35
+ }
36
+
20
37
// ComputeKubeletFlags returns the flags to use when starting the kubelet.
21
38
func ComputeKubeletFlags (startingArgs map [string ][]string , options configapi.NodeConfig ) ([]string , error ) {
22
39
args := map [string ][]string {}
@@ -127,7 +144,11 @@ func ComputeKubeletFlags(startingArgs map[string][]string, options configapi.Nod
127
144
var arguments []string
128
145
for _ , key := range keys {
129
146
for _ , token := range args [key ] {
130
- arguments = append (arguments , fmt .Sprintf ("--%s=%v" , key , token ))
147
+ if len (token ) > 0 {
148
+ arguments = append (arguments , fmt .Sprintf ("--%s=%v" , key , shellEscapeArg (token )))
149
+ } else {
150
+ arguments = append (arguments , fmt .Sprintf ("--%s=%v" , key , token ))
151
+ }
131
152
}
132
153
}
133
154
return arguments , nil
0 commit comments