[PATCH 1/1] image-accounts: directly pass arguments to openssl instead of shell

[PATCH 1/1] image-accounts: directly pass arguments to openssl instead of shell

['Felix Moessbauer' via isar-users]

When hashing the password, the whole openssl command was passed as a
shell string instead of directly passing the individual arguments as-is.
Further, the arguments were not shell escaped. By that, passwords
containing a string were split into two individual arguments, breaking
the command (or silently set a different password if the remainder
itself was a valid argument).

We fix this by passing the arguments as-is (as list) to bb.process.run.

Fixes: 6144daf9 ("image-account-extension: Avoid deprecated crypt...")
Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes/image-account-extension.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
index 3c461b1a..25288e76 100644
--- a/meta/classes/image-account-extension.bbclass
+++ b/meta/classes/image-account-extension.bbclass
@@ -133,7 +133,7 @@ def image_create_users(d: "DataSmart") -> None:
                 source_date_epoch = d.getVar("SOURCE_DATE_EPOCH")
                 command.append("-e")
                 salt = hashlib.sha256("{}\n".format(source_date_epoch).encode()).hexdigest()[0:15]
-                password = bb.process.run('openssl passwd -6 --salt {} {}'.format(salt, password))[0].strip()
+                password = bb.process.run(['openssl', 'passwd', '-6', '--salt', salt, password])[0].strip()
 
             else:
                 command.append("-e")
-- 
2.49.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250612155610.473593-1-felix.moessbauer%40siemens.com.