Skip to content

Commit

Permalink
fix: escape dollar sign from args
Browse files Browse the repository at this point in the history
IPMI commands get executed in a separate shell where the combination "status" has its own behavior. In our case,
Popen starts a new shell, for example by running /bin/bash, and when the BMC password contains the combination
above it gets replaced to "bin/bash" (in this case the combination holds the last executed command as a string).
I have added a method to Session class that will escape the dollar sign. Such behavior is expected with other signs
(like combination "^_") but I didn't find it critical.

Signed-off-by: FrenkenFlores <[email protected]>
  • Loading branch information
FrenkenFlores committed Jan 6, 2025
1 parent 5344f4e commit 6a7a664
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions pyipmi/session.py
Original file line number Diff line number Diff line change
Expand Up @@ -107,11 +107,18 @@ def set_auth_type_user(self, username, password):

@property
def auth_username(self):
return self._auth_username
return self._escape_dollar_sign(self._auth_username)

@property
def auth_password(self):
return self._auth_password
return self._escape_dollar_sign(self._auth_password)

def _escape_dollar_sign(self, password):
"""Escape string with dollar sign in ipmitool."""
# The IPMI command is built and executed in a shell using Popen.
# The '$_' combination has its own behavior in shell and it gets
# replaced in the string.
return password.replace('$', '\$')

def establish(self):
if hasattr(self.interface, 'establish_session'):
Expand Down

0 comments on commit 6a7a664

Please sign in to comment.