ganglia-logtailer quoting arguments in shelling out to prevent special characters from doing terrible things #35
Conversation
…doing terrible things
|
I'd think that it should be sanitizing the metric names beforehand, rather than passing junk back to the collector. I know that some of that is done already with special characters in some of the C code, but I'd think it would make sense to do the same here. |
|
Do you know what the list of allowed characters is for a metric name? If not, could you point me at where it does this in the C code? I'm not finding it at the moment. :( (still looking though) |
|
(fwiw, gmond seems to handle these random special characters just fine.) |
…es. switching to subprocess.call for better protection
|
To separate fixing the current bug where ganglia-logtailer breaks and spews cronspam on badly formed metrics from the feature request that it sanitize names in the same way as ganglia-core, I created #36 to track the latter so this can be merged separately. |
|
I'm only sanitizing the name here, though the same rules should probably apply to the value. |
ganglia-logtailer quoting arguments in shelling out to prevent special characters from doing terrible things
unquoted & in something like the metric name will be interpreted by the shell and cause terrible side effects.