CV-2: Python code injection via hostname interpolation into remote exec strings

[szachovy]

Problem

Node hostnames are interpolated directly into Python source strings that are compiled and executed on remote nodes via run_python_container_command(). A malicious hostname could break out of the string literal and execute arbitrary Python on the target container.

The existing hostname validation uses re.match() which only anchors at the start of the string — a hostname like node-0\n; import os could bypass it. The same interpolation pattern also exists for virtual_ip_address, virtual_network_mask, virtual_network_interface, state, and priority parameters.

File: src/initialize.py, lines 145–156, 227–247

Fix

1. Anchor the hostname regex: change re.compile(r"[A-Z\d-]{1,63}") to re.compile(r"^[A-Z\d-]{1,63}$") or use re.fullmatch()

2. Use repr() for all values interpolated into Python source strings:

"'/opt/store_credentials.exp {mysql_nodes}'".format(
    mysql_nodes=" ".join(repr(node.node) for node in self.mysql_nodes)
)

3. Long-term: pass parameters as command-line args or environment variables to the uploaded script, not via string interpolation.

Acceptance Criteria

• Hostname regex anchored with ^ and $ (or use re.fullmatch()) to prevent partial matches
• All values interpolated into Python source strings use repr() to safely escape them
• Long-term: parameters passed as command-line args or env vars, not string-interpolated