From 2af5c3b442ea5347f75c1f6babd91f6161fd68cf Mon Sep 17 00:00:00 2001 From: apvxlab Date: Mon, 13 Jul 2026 07:45:28 -0700 Subject: [PATCH] Prevent command injection via SolrBackup.spec.location EnsureDirectoryForBackup built a shell command by concatenating the user-controlled backup location into "/bin/bash -c \"mkdir -p \" + path" and exec'ing it in the Solr pod. A SolrBackup.spec.location containing shell metacharacters (e.g. "x; touch /tmp/pwned;") therefore executed arbitrary commands in the pod as the SolrCloud service account. Exec mkdir in argv form (["mkdir","-p",backupPath]) with no shell, so the path is treated as a single literal argument and metacharacters are inert. Co-Authored-By: Claude Opus 4.8 Signed-off-by: apvxlab --- controllers/util/backup_util.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/controllers/util/backup_util.go b/controllers/util/backup_util.go index ca4056e1..c2e4eb01 100644 --- a/controllers/util/backup_util.go +++ b/controllers/util/backup_util.go @@ -146,10 +146,14 @@ func EnsureDirectoryForBackup(solrCloud *solr.SolrCloud, backupRepository *solr. // Directory creation only required/possible for volume (i.e. local) backups if IsRepoVolume(backupRepository) { backupPath := BackupLocationPath(backupRepository, backup.Spec.Location) + // Exec mkdir directly (argv form) rather than through "/bin/bash -c". + // backupPath is derived from the user-controlled SolrBackup.spec.location; + // passing it through a shell allowed command injection. As a discrete argv + // element it is treated as a literal path and shell metacharacters are inert. return RunExecForPod( solrCloud.GetAllSolrPodNames()[0], solrCloud.Namespace, - []string{"/bin/bash", "-c", "mkdir -p " + backupPath}, + []string{"mkdir", "-p", backupPath}, config, ) }