system: cron parameters are escaped properly nowadays

This is allowed nowadays with the proper escaping in the
template employed.  However...

1. The parameter"s" are enforced by doing white-space
separated passing of individiual parts, but that breaks
backend scripts expecting either spaces to be part of
the parmeter or discarding additional parameters.

This matters, because...

2. https://docs.opnsense.org/manual/settingsmenu.html#cron
does not state any two parameter value of interest to
users apart from custom Cron glue.

I'd rather have "parameters" treated as a single first
parameter which can be passed with a %s to the shell, but
I'm unsure if configd will treat it that way?  At least
the crontab part would not be the issue.

Let's test this theory:

  # cat src/opnsense/service/conf/actions.d/actions_test.conf
  [shell]
  command:/bin/csh -c
  parameters:%s
  message:Running %s
  type:script_output
  description:Shell execution (use with care)

  # configctl test shell "echo foo"
  Parameter mismatch

  # configctl test shell "echo\ foo"
  foo

  # configctl test shell "echo\ foo;echo\ bar"
  foo
  bar

So there seems to be a mishandling of spaces in general
which is probably why the parameters are treated as such
in the crontab file.  Perhaps we need to discuss this.
This commit is contained in:
Franco Fichtner 2023-09-11 11:40:00 +02:00
parent 36d250f929
commit a8c348cfa4

View File

@ -57,8 +57,8 @@
<Required>Y</Required>
</command>
<parameters type="TextField">
<mask>/^([^;|`]){1,255}$/</mask>
<ValidationMessage>Enter valid parameter(s) for the chosen command (Found illegal characters).</ValidationMessage>
<mask>/^(.){1,255}$/</mask>
<ValidationMessage>Input too long.</ValidationMessage>
</parameters>
<description type="TextField">
<mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_\x{00A0}-\x{FFFF}]){1,255}$/u</mask>