{"action":"created","issue":{"url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/427","labels_url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/427/labels{/name}","comments_url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/427/comments","events_url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/427/events","html_url":"https://github.com/crowbar/barclamp-provisioner/pull/427","id":87676723,"number":427,"title":"Allow only legal characters in names of additional packages and put them in quotes","user":{"login":"thutterer","id":5372947,"avatar_url":"https://avatars.githubusercontent.com/u/5372947?v=3","gravatar_id":"","url":"https://api.github.com/users/thutterer","html_url":"https://github.com/thutterer","followers_url":"https://api.github.com/users/thutterer/followers","following_url":"https://api.github.com/users/thutterer/following{/other_user}","gists_url":"https://api.github.com/users/thutterer/gists{/gist_id}","starred_url":"https://api.github.com/users/thutterer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thutterer/subscriptions","organizations_url":"https://api.github.com/users/thutterer/orgs","repos_url":"https://api.github.com/users/thutterer/repos","events_url":"https://api.github.com/users/thutterer/events{/privacy}","received_events_url":"https://api.github.com/users/thutterer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-06-12T09:58:50Z","updated_at":"2015-06-17T15:44:12Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/crowbar/barclamp-provisioner/pulls/427","html_url":"https://github.com/crowbar/barclamp-provisioner/pull/427","diff_url":"https://github.com/crowbar/barclamp-provisioner/pull/427.diff","patch_url":"https://github.com/crowbar/barclamp-provisioner/pull/427.patch"},"body":"I would like to improve string handling in the _additional packages_ feature.\r\nWithout that, it accepts any string as a package name.\r\nThis can be exploited with `crowbar_register` e.g. with `; rm foo; zypper in ` as a package name.\r\n\r\nThe first commit adds a validation RegEx that only allows characters from the [package naming guidelines](https://en.opensuse.org/openSUSE:Package_naming_guidelines#Common_Character_Set_for_Package_Naming) plus the version number operater chars (`< > =`).\r\n\r\nThe second commit concerns only `crowbar_register` and puts quotes around every package name there. Otherwise you couldn't use the version operator as you would redirect stdin or stdout. (e.g. `'emacs>4.0'`)"},"comment":{"url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/comments/112855536","html_url":"https://github.com/crowbar/barclamp-provisioner/pull/427#issuecomment-112855536","issue_url":"https://api.github.com/repos/crowbar/barclamp-provisioner/issues/427","id":112855536,"user":{"login":"rsalevsky","id":4128547,"avatar_url":"https://avatars.githubusercontent.com/u/4128547?v=3","gravatar_id":"","url":"https://api.github.com/users/rsalevsky","html_url":"https://github.com/rsalevsky","followers_url":"https://api.github.com/users/rsalevsky/followers","following_url":"https://api.github.com/users/rsalevsky/following{/other_user}","gists_url":"https://api.github.com/users/rsalevsky/gists{/gist_id}","starred_url":"https://api.github.com/users/rsalevsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rsalevsky/subscriptions","organizations_url":"https://api.github.com/users/rsalevsky/orgs","repos_url":"https://api.github.com/users/rsalevsky/repos","events_url":"https://api.github.com/users/rsalevsky/events{/privacy}","received_events_url":"https://api.github.com/users/rsalevsky/received_events","type":"User","site_admin":false},"created_at":"2015-06-17T15:44:12Z","updated_at":"2015-06-17T15:44:12Z","body":"+1"}}