<commit_before>(*
 * Copyright (C) 2006-2009 Citrix Systems Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published
 * by the Free Software Foundation; version 2.1 only. with the special
 * exception on linking described in file LICENSE.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *)
(**
 * @group Virtual-Machine Management
 *)
 
open Pervasiveext
open Client
open Forkhelpers
open Xapi_templates
open Attach_helpers

module D = Debug.Make(struct let name="xapi" end)
open D

let is_whitelisted script =
  let safe_char = function 'a'..'z'-> true |'-'->true |'/'->true |_ -> false in
  let safe_str str = List.fold_left (&&) true (List.map safe_char (Xstringext.String.explode str)) in
  (* make sure the script prefix is the allowed dom0 directory *)
  (Xstringext.String.startswith !Xapi_globs.post_install_scripts_dir script)
  (* avoid ..-style attacks and other weird things *)
  &&(safe_str script)
let assert_script_is_whitelisted script =
  if not (is_whitelisted script) then
    raise (Api_errors.Server_error (Api_errors.permission_denied, [
      (Printf.sprintf "illegal provision script %s" script)]))

(** Execute the post install script of 'vm' having attached all the vbds to the 'install_vm' *)
let post_install_script rpc session_id __context install_vm vm (script, vbds) =
  (* Cancellable task *)<commit_msg>CP-9401: Correctly check provision scripts are whitelisted<commit_after>(*
 * Copyright (C) 2006-2009 Citrix Systems Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published
 * by the Free Software Foundation; version 2.1 only. with the special
 * exception on linking described in file LICENSE.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *)
(**
 * @group Virtual-Machine Management
 *)
 
open Pervasiveext
open Client
open Forkhelpers
open Xapi_templates
open Attach_helpers

module D = Debug.Make(struct let name="xapi" end)
open D

let is_whitelisted script =
  let safe_char = function 'a'..'z'-> true |'-'->true |'/'->true |_ -> false in
  let safe_str str = List.fold_left (&&) true (List.map safe_char (Xstringext.String.explode str)) in
  (* make sure the script prefix is the allowed dom0 directory *)
  (Filename.dirname script = !Xapi_globs.post_install_scripts_dir)
  (* avoid ..-style attacks and other weird things *)
  &&(safe_str script)
let assert_script_is_whitelisted script =
  if not (is_whitelisted script) then
    raise (Api_errors.Server_error (Api_errors.permission_denied, [
      (Printf.sprintf "illegal provision script %s" script)]))

(** Execute the post install script of 'vm' having attached all the vbds to the 'install_vm' *)
let post_install_script rpc session_id __context install_vm vm (script, vbds) =
  (* Cancellable task *)
{'fraction_non_alphanumeric': 0.08546494131808606, 'fraction_numerical': 0.007824255191092387, 'mean_word_length': 4.378640776699029, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1064573', 'n_tokens_mistral': 978, 'n_tokens_neox': 954, 'n_words': 398}