From e30f547891661904bda5bd35bbb19e8d4e24e1bc Mon Sep 17 00:00:00 2001
From: Hungerdream <1710233908@qq.com>
Date: Tue, 28 Jul 2026 19:14:50 +0800
Subject: [PATCH] fix(ansible): harden mysql data_disk path validation

Reject bare '/', path traversal ('..') and duplicated slashes ('//') in mysql_data_disk assertions to avoid deploying into unsafe directories.
---
 ansible/mysql-deploy.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ansible/mysql-deploy.yml b/ansible/mysql-deploy.yml
index 28e5ec9..a256b6f 100644
--- a/ansible/mysql-deploy.yml
+++ b/ansible/mysql-deploy.yml
@@ -74,7 +74,10 @@
           - topology in ['standalone', 'primary_replica', 'mgr_3']
           - mysql_instance is match('^[a-z0-9][a-z0-9-]{0,62}$')
           - mysql_version_value in mysql_package_map
-          - mysql_data_disk is match('^/')
+          - mysql_data_disk is match('^/.+')
+          - mysql_data_disk != '/'
+          - "'..' not in mysql_data_disk"
+          - "'//' not in mysql_data_disk"
           - (mysql_port_value | int) >= 13306
           - (mysql_port_value | int) <= 13999
           - (mysql_memory_mb_value | int) >= 2048