Merge remote-tracking branch 'upstream/4.22' into nas-backport-upstream

# Conflicts:
#	plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java
#	scripts/vm/hypervisor/kvm/nasbackup.sh

Author: abh1sar

api/src/main/java/org/apache/cloudstack/api/ApiArgValidator.java

@@ -17,9 +17,18 @@
 
 package org.apache.cloudstack.api;
 
+import java.util.Locale;
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.UuidUtils;
+
 public enum ApiArgValidator {
     /**
-     * Validates if the parameter is null or empty with the method {@link Strings#isNullOrEmpty(String)}.
+     * Validates if the parameter is null or empty with the method {@link StringUtils#isEmpty(CharSequence)}.
+     * Validation is currently done in the method ParamProcessWorker#validateNonEmptyString(String, String).
      */
     NotNullOrEmpty,
 
@@ -29,12 +38,72 @@ public enum ApiArgValidator {
     PositiveNumber,
 
     /**
-     * Validates if the parameter is an UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validates if the parameter is a UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validation is currently done in the method ParamProcessWorker#validateUuidString(String, String).
      */
     UuidString,
 
     /**
      * Validates if the parameter is a valid RFC Compliance domain name.
      */
     RFCComplianceDomainName,
+
+    /**
+     * Validates command option strings to avoid unsafe/code-like content.
+     */
+    SafeCommandOptions((param, annotation) -> {
+        if (BaseCmd.CommandType.STRING.equals(annotation.type())) {
+            validateSafeCommandOptions(param, annotation.name());
+        }
+    });
+
+    private static final Pattern SAFE_COMMAND_OPTIONS_PATTERN = Pattern.compile("^[A-Za-z0-9,._=:/+\\-\\s]*$");
+
+    private static final String[] UNSAFE_TOKENS = {
+            "$(", "`", "&&", "||", ";", "|", ">", "<"
+    };
+
+    private final ValidationRule rule;
+
+    ApiArgValidator() {
+        this(null);
+    }
+
+    ApiArgValidator(ValidationRule rule) {
+        this.rule = rule;
+    }
+
+    public void validate(final Object paramObj, final Parameter annotation) {
+        if (rule != null) {
+            rule.validate(paramObj, annotation);
+        }
+    }
+
+    private static void validateSafeCommandOptions(final Object param, final String argName) {
+        final String value = String.valueOf(param);
+        if (StringUtils.isBlank(value)) {
+            return;
+        }
+
+        if (!SAFE_COMMAND_OPTIONS_PATTERN.matcher(value).matches()) {
+            throwInvalidParameterValueException(argName, "contains unsupported or unsafe characters");
+        }
+
+        final String normalized = value.toLowerCase(Locale.ROOT);
+        for (String token : UNSAFE_TOKENS) {
+            if (normalized.contains(token)) {
+                throwInvalidParameterValueException(argName, "contains code-like or unsafe content");
+            }
+        }
+    }
+
+    private static void throwInvalidParameterValueException(final String argName, final String customMsg) {
+        throw new InvalidParameterValueException(String.format("Invalid value provided for API arg: %s%s", argName,
+                StringUtils.isBlank(customMsg) ? "" : " - " + customMsg));
+    }
+
+    @FunctionalInterface
+    interface ValidationRule {
+        void validate(Object paramObj, Parameter annotation);
+    }
 }

api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ResetVMPasswordCmdByAdmin.java

@@ -27,5 +27,5 @@
 @APICommand(name = "resetPasswordForVirtualMachine", responseObject=UserVmResponse.class, description = "Resets the password for Instance. " +
                     "The Instance must be in a \"Stopped\" state and the Template must already " +
         "support this feature for this command to take effect. [async]", responseView = ResponseView.Full, entityType = {VirtualMachine.class},
-        requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
+        requestHasSensitiveInfo = true, responseHasSensitiveInfo = true)
 public class ResetVMPasswordCmdByAdmin extends ResetVMPasswordCmd implements AdminCmd {}

api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java

@@ -22,6 +22,7 @@
 import org.apache.commons.collections.MapUtils;
 
 import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
@@ -106,6 +107,7 @@ public class CreateAutoScaleVmProfileCmd extends BaseAsyncCreateCmd {
             since = "4.18.0")
     private String userData;
 
+    @ACL
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.18.1")
     private Long userDataId;
 

api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/UpdateAutoScaleVmProfileCmd.java

@@ -101,6 +101,7 @@ public class UpdateAutoScaleVmProfileCmd extends BaseAsyncCustomIdCmd {
             since = "4.18.0")
     private String userData;
 
+    @ACL
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the userdata",
             since = "4.18.1")
     private Long userDataId;

api/src/main/java/org/apache/cloudstack/api/command/user/backup/repository/AddBackupRepositoryCmd.java

@@ -20,6 +20,7 @@
 import com.cloud.utils.StringUtils;
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiArgValidator;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
@@ -57,7 +58,8 @@ public class AddBackupRepositoryCmd extends BaseCmd {
     @Parameter(name = ApiConstants.PROVIDER, type = CommandType.STRING, description = "backup repository provider")
     private String provider;
 
-    @Parameter(name = ApiConstants.MOUNT_OPTIONS, type = CommandType.STRING, description = "shared storage mount options")
+    @Parameter(name = ApiConstants.MOUNT_OPTIONS, type = CommandType.STRING, description = "shared storage mount options",
+            validations = {ApiArgValidator.SafeCommandOptions})
     private String mountOptions;
 
     @Parameter(name = ApiConstants.ZONE_ID,

api/src/main/java/org/apache/cloudstack/api/command/user/backup/repository/UpdateBackupRepositoryCmd.java

@@ -17,8 +17,11 @@
 
 package org.apache.cloudstack.api.command.user.backup.repository;
 
+import javax.inject.Inject;
+
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiArgValidator;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
@@ -29,8 +32,6 @@
 import org.apache.cloudstack.backup.BackupRepositoryService;
 import org.apache.cloudstack.context.CallContext;
 
-import javax.inject.Inject;
-
 @APICommand(name = "updateBackupRepository",
         description = "Update a backup repository",
         responseObject = BackupRepositoryResponse.class, since = "4.22.0",
@@ -53,7 +54,8 @@ public class UpdateBackupRepositoryCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ADDRESS, type = CommandType.STRING, description = "address of the backup repository")
     private String address;
 
-    @Parameter(name = ApiConstants.MOUNT_OPTIONS, type = CommandType.STRING, description = "shared storage mount options")
+    @Parameter(name = ApiConstants.MOUNT_OPTIONS, type = CommandType.STRING, description = "shared storage mount options",
+            validations = {ApiArgValidator.SafeCommandOptions})
     private String mountOptions;
 
     @Parameter(name = ApiConstants.CROSS_ZONE_INSTANCE_CREATION, type = CommandType.BOOLEAN, description = "backups in this repository can be used to create Instances on all Zones")

api/src/main/java/org/apache/cloudstack/api/command/user/userdata/DeleteUserDataCmd.java

@@ -17,6 +17,8 @@
 package org.apache.cloudstack.api.command.user.userdata;
 
 import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.acl.SecurityChecker;
+import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
@@ -27,7 +29,6 @@
 import org.apache.cloudstack.api.response.ProjectResponse;
 import org.apache.cloudstack.api.response.SuccessResponse;
 import org.apache.cloudstack.api.response.UserDataResponse;
-import org.apache.cloudstack.context.CallContext;
 
 import com.cloud.user.Account;
 import com.cloud.user.UserData;
@@ -43,6 +44,7 @@ public class DeleteUserDataCmd extends BaseCmd {
     //////////////// API parameters /////////////////////
     /////////////////////////////////////////////////////
 
+    @ACL(accessType = SecurityChecker.AccessType.OperateEntry)
     @Parameter(name = ApiConstants.ID, type = CommandType.UUID, required = true, entityType = UserDataResponse.class, description = "The ID of the Userdata")
     private Long id;
 
@@ -97,18 +99,13 @@ public void execute() {
 
     @Override
     public long getEntityOwnerId() {
-        Account account = CallContext.current().getCallingAccount();
-        if ((account == null || _accountService.isAdmin(account.getId())) && (domainId != null && accountName != null)) {
-            Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
-            if (userAccount != null) {
-                return userAccount.getId();
+        if (id != null) {
+            UserData userData = _entityMgr.findById(UserData.class, id);
+            if (userData != null) {
+                return userData.getAccountId();
             }
         }
 
-        if (account != null) {
-            return account.getId();
-        }
-
         return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked
     }
 }

api/src/main/java/org/apache/cloudstack/api/command/user/userdata/LinkUserDataToTemplateCmd.java

@@ -18,6 +18,8 @@
 package org.apache.cloudstack.api.command.user.userdata;
 
 import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.acl.SecurityChecker.AccessType;
+import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
@@ -56,6 +58,7 @@ public class LinkUserDataToTemplateCmd extends BaseCmd implements AdminCmd {
             description = "The ID of the ISO for the Instance")
     private Long isoId;
 
+    @ACL(accessType = AccessType.OperateEntry)
     @Parameter(name = ApiConstants.USER_DATA_ID,
             type = CommandType.UUID,
             entityType = UserDataResponse.class,

api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java

@@ -149,6 +149,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
             length = 1048576)
     private String userData;
 
+    @ACL
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.18")
     private Long userdataId;
 

api/src/main/java/org/apache/cloudstack/api/command/user/vm/ResetVMPasswordCmd.java

@@ -42,7 +42,7 @@
 @APICommand(name = "resetPasswordForVirtualMachine", responseObject=UserVmResponse.class, description = "Resets the password for the Instance. " +
                     "The Instance must be in a \"Stopped\" state and the Template must already " +
         "support this feature for this command to take effect. [async]", responseView = ResponseView.Restricted, entityType = {VirtualMachine.class},
-    requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
+    requestHasSensitiveInfo = true, responseHasSensitiveInfo = true)
 public class ResetVMPasswordCmd extends BaseAsyncCmd implements UserCmd {
 
     private static final String s_name = "resetpasswordforvirtualmachineresponse";