Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Problem
When configctl is invoked with empty string arguments (e.g., to skip optional positional parameters), the empty strings are silently discarded, causing all subsequent arguments to shift left into the wrong parameter positions.
Root Cause
|
exec_commands=[' '.join(args.command)] |
The
' '.join() on
args.command converts empty strings into zero-width gaps between spaces. When configd receives this string and parses it with
shlex.split(), consecutive spaces are treated as a single delimiter, the empty parameters are lost entirely.
Example: configctl filter list states '' 5 '' '' ''
The value 5 lands in --filter instead of --limit.
This affects any action where callers need to skip leading positional parameters. The PHP equivalent (Backend::configdpRun) does not have this bug because it uses escapeshellarg() which preserves empty strings as '' tokens.
Suggested Fix
Modify core/src/opnsense/service/configd_ctl.py
import shlex # add import
# line 114: replace
exec_commands=[' '.join(args.command)]
# with
exec_commands=[' '.join(shlex.quote(c) for c in args.command)]
This mirrors what PHP's Backend::configdpRun already does with escapeshellarg(). Both preserve empty strings as quoted '' tokens. On the configd daemon side, shlex.split() in processhandler.py already correctly reconstructs '' back into empty strings, so no changes are needed there.
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Problem
When configctl is invoked with empty string arguments (e.g., to skip optional positional parameters), the empty strings are silently discarded, causing all subsequent arguments to shift left into the wrong parameter positions.
Root Cause
core/src/opnsense/service/configd_ctl.py
Line 114 in 56ea14f
The
' '.join()onargs.commandconverts empty strings into zero-width gaps between spaces. When configd receives this string and parses it withshlex.split(), consecutive spaces are treated as a single delimiter, the empty parameters are lost entirely.Example:
configctl filter list states '' 5 '' '' ''The value 5 lands in --filter instead of --limit.
This affects any action where callers need to skip leading positional parameters. The PHP equivalent (
Backend::configdpRun) does not have this bug because it usesescapeshellarg()which preserves empty strings as '' tokens.Suggested Fix
Modify core/src/opnsense/service/configd_ctl.py
This mirrors what PHP's
Backend::configdpRunalready does withescapeshellarg(). Both preserve empty strings as quoted '' tokens. On the configd daemon side,shlex.split()in processhandler.py already correctly reconstructs '' back into empty strings, so no changes are needed there.