Fix Python code injection via hostname interpolation

Anchor hostname regex with ^ and $ to prevent partial matches. Use
repr() for all values interpolated into Python source strings passed
to run_python_container_command(). Prevents string literal breakout
via crafted hostnames or parameters.

Closes #86

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
 
+### Fixed
+
+* Anchor hostname regex and use repr() for all string-interpolated remote exec values. (#86)
+
 ### Changed
 
 * Completed [ARCHITECTURE.md](./docs/ARCHITECTURE.md) (#93)

src/initialize.py

@@ -94,9 +94,9 @@ def validate_nodes(self) -> None:
 
         def validate_hostname(hostname: str) -> str:
             """(RFC 1123 compliance)."""
-            allowed_characters = re.compile(r"[A-Z\d-]{1,63}", re.IGNORECASE)
+            allowed_characters = re.compile(r"^[A-Z\d-]{1,63}$", re.IGNORECASE)
             if not ((len(hostname) > 255) or ("." in hostname)):
-                if all(allowed_characters.match(x) for x in hostname):
+                if allowed_characters.match(hostname):
                     return hostname
             raise ValueError("Invalid node hostname provided")
 
@@ -152,7 +152,7 @@ def get_mylogin_cnf(self, node: remote.RemoteConnection) -> bytes:
                         {{'MYSQL_TEST_LOGIN_FILE': '/var/run/mysqld/.mylogin.cnf'}} \
                     ) \
                 )".format(
-                    mysql_nodes=" ".join(node.node for node in self.mysql_nodes))
+                    mysql_nodes=" ".join(repr(node.node) for node in self.mysql_nodes))
                 )["output"]
             mylogin_cnf = base64.b64decode(output[2:-2].replace("\\n", ""))
             if len(mylogin_cnf) > 320:
@@ -228,22 +228,22 @@ def start_mysql_mgmt(self, node: remote.RemoteConnection, state: str, priority:
             "ContainerConnection( \
                 container='mysql-mgmt' \
             ).run_mysql_mgmt( \
-                '{virtual_ip_address}', \
-                '{virtual_network_mask}', \
-                '{virtual_network_interface}', \
-                '{primary_mysql_node}', \
-                '{secondary_first_mysql_node}', \
-                '{secondary_second_mysql_node}', \
-                '{state}', \
-                '{priority}' \
-            )".format(virtual_ip_address=self.virtual_ip_address,
-                      virtual_network_mask=self.virtual_network_mask,
-                      virtual_network_interface=self.virtual_network_interface,
-                      primary_mysql_node=self.mysql_nodes[0].node,
-                      secondary_first_mysql_node=self.mysql_nodes[1].node,
-                      secondary_second_mysql_node=self.mysql_nodes[2].node,
-                      state=state,
-                      priority=priority)
+                {virtual_ip_address}, \
+                {virtual_network_mask}, \
+                {virtual_network_interface}, \
+                {primary_mysql_node}, \
+                {secondary_first_mysql_node}, \
+                {secondary_second_mysql_node}, \
+                {state}, \
+                {priority} \
+            )".format(virtual_ip_address=repr(self.virtual_ip_address),
+                      virtual_network_mask=repr(str(self.virtual_network_mask)),
+                      virtual_network_interface=repr(self.virtual_network_interface),
+                      primary_mysql_node=repr(self.mysql_nodes[0].node),
+                      secondary_first_mysql_node=repr(self.mysql_nodes[1].node),
+                      secondary_second_mysql_node=repr(self.mysql_nodes[2].node),
+                      state=repr(state),
+                      priority=repr(str(priority)))
         )
 
     def start_superset(self) -> None:
@@ -272,12 +272,12 @@ def start_superset(self) -> None:
                 "ContainerConnection( \
                     container='superset' \
                 ).run_superset( \
-                    '{virtual_ip_address}', \
-                    '{superset_secret_key}', \
-                    '{mysql_superset_password}' \
-                )".format(virtual_ip_address=self.virtual_ip_address,
-                          superset_secret_key=self.superset_secret_key,
-                          mysql_superset_password=self.mysql_superset_password)
+                    {virtual_ip_address}, \
+                    {superset_secret_key}, \
+                    {mysql_superset_password} \
+                )".format(virtual_ip_address=repr(self.virtual_ip_address),
+                          superset_secret_key=repr(self.superset_secret_key),
+                          mysql_superset_password=repr(self.mysql_superset_password))
             )
 
     def start_cluster(self) -> None: