Jian Qiu bb4e9a4e13 fix(webconsole): harden climc shell command execution against injection (#25476) ...

- Run ssh via exec.Command argv instead of "bash -c" string
  interpolation, so user-supplied fields can no longer escape into
  local shell commands on the webconsole server
- Quote every interpolated value (env, command, args) as a POSIX
  shell word, so they stay literal data on the remote shell
- Validate username charset and limit target_ip to climc pod or container
- Add unit tests covering injection payloads

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 10:51:51 +08:00

..

adb_command.go

…

climc_ssh_command_test.go

fix(webconsole): harden climc shell command execution against injection (#25476)

2026-09-03 10:51:51 +08:00

climc_ssh_command.go

fix(webconsole): harden climc shell command execution against injection (#25476)

2026-09-03 10:51:51 +08:00

command.go

…

doc.go

…

ipmi_command.go

…

kube_command_test.go

…

kube_command.go

…

socat_command.go

…