wonder/xinfra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ansible): harden mysql data_disk path validation

Browse Source 
Reject bare '/', path traversal ('..') and duplicated slashes ('//') in mysql_data_disk assertions to avoid deploying into unsafe directories.
This commit is contained in:
Hungerdream
2026-07-28 19:14:50 +08:00
parent 6ce8ab74d5
commit e30f547891
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/mysql-deploy.yml
+4 -1
View File
@@ -74,7 +74,10 @@
- topology in ['standalone', 'primary_replica', 'mgr_3'] - topology in ['standalone', 'primary_replica', 'mgr_3']
- mysql_instance is match('^[a-z0-9][a-z0-9-]{0,62}$') - mysql_instance is match('^[a-z0-9][a-z0-9-]{0,62}$')
- mysql_version_value in mysql_package_map - mysql_version_value in mysql_package_map
- mysql_data_disk is match('^/') - mysql_data_disk is match('^/.+')
- mysql_data_disk != '/'
- "'..' not in mysql_data_disk"
- "'//' not in mysql_data_disk"
- (mysql_port_value | int) >= 13306 - (mysql_port_value | int) >= 13306
- (mysql_port_value | int) <= 13999 - (mysql_port_value | int) <= 13999
- (mysql_memory_mb_value | int) >= 2048 - (mysql_memory_mb_value | int) >= 2048