client/rhel/spacewalk-oscap/scap.py | 29 +++++++++++++++++++++++------
1 file changed, 23 insertions(+), 6 deletions(-)
New commits:
commit f3138def8c2aa21a6f09daab43525ea2e1f21fd7
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Thu May 31 14:04:03 2012 +0200
Forbid oscap args other than --profile and --skip-valid
diff --git a/client/rhel/spacewalk-oscap/scap.py b/client/rhel/spacewalk-oscap/scap.py
index e9a21b6..01dba2c 100644
--- a/client/rhel/spacewalk-oscap/scap.py
+++ b/client/rhel/spacewalk-oscap/scap.py
@@ -16,12 +16,8 @@ def xccdf_eval(args, cache_only=None):
return (0, 'no-ops for caching', {})
results_file = tempfile.NamedTemporaryFile()
- if args['params']:
- oscap_err = _run_oscap(['xccdf', 'eval', '--results', results_file.name]
- + args['params'].split(' ') + [args['path']])
- else:
- oscap_err = _run_oscap(['xccdf', 'eval', '--results', results_file.name]
- + [args['path']])
+ params, oscap_err = _process_params(args['params'], results_file.name)
+ oscap_err += _run_oscap(['xccdf', 'eval'] + params + [args['path']])
if not _assert_xml(results_file.name):
return (1, 'oscap tool did not produce valid xml.\n' + oscap_err, {})
@@ -59,6 +55,27 @@ def _popen(args):
return subprocess.Popen(args, bufsize=-1, stdin=subprocess.PIPE,
stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
+def _process_params(args, filename):
+ params = ['--results', filename]
+ errors = ''
+ if args:
+ allowed_args = {'--profile': 1, '--skip-valid': 0}
+ args = args.split(' ')
+ i = 0
+ while i < len(args):
+ if args[i] in allowed_args:
+ j = i + allowed_args[args[i]]
+ params += args[i:j+1]
+ i = j
+ elif not errors:
+ errors = 'xccdf_eval: Following arguments forbidden: ' + args[i]
+ else:
+ errors += ' ' + args[i]
+ i += 1
+ if errors:
+ errors += '\n'
+ return params, errors
+
def _assert_xml(filename):
f = open(filename, 'rb')
try: