[lxc-devel] [lxd/master] Project: Reject quotes in project names

[tomponline on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 514 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20201113/a36f0732/attachment.bin>
-------------- next part --------------
From 4288422d191c7b47e268464f383903c7f4c953e5 Mon Sep 17 00:00:00 2001
From: Thomas Parrott <thomas.parrott at canonical.com>
Date: Fri, 13 Nov 2020 14:20:23 +0000
Subject: [PATCH] lxd/api/project: Reject quotes in project names

This is because some storage drivers cannot support quotes in the volume name.

Also AppArmor policies do not support double quotes in their names.

Signed-off-by: Thomas Parrott <thomas.parrott at canonical.com>
---
 lxd/api_project.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lxd/api_project.go b/lxd/api_project.go
index 5f22f62667..85de1f61b2 100644
--- a/lxd/api_project.go
+++ b/lxd/api_project.go
@@ -587,6 +587,10 @@ func projectValidateName(name string) error {
 		return fmt.Errorf("Project names may not contain spaces")
 	}
 
+	if strings.Contains(name, "'") || strings.Contains(name, `"`) {
+		return fmt.Errorf("Project names may not contain quotes")
+	}
+
 	if name == "*" {
 		return fmt.Errorf("Reserved project name")
 	}