Skip to content

Commit 6a7a664

Browse files
committed
fix: escape dollar sign from args
IPMI commands get executed in a separate shell where the combination "status" has its own behavior. In our case, Popen starts a new shell, for example by running /bin/bash, and when the BMC password contains the combination above it gets replaced to "bin/bash" (in this case the combination holds the last executed command as a string). I have added a method to Session class that will escape the dollar sign. Such behavior is expected with other signs (like combination "^_") but I didn't find it critical. Signed-off-by: FrenkenFlores <saifualdin.evloev@gmail.com>
1 parent 5344f4e commit 6a7a664

1 file changed

Lines changed: 9 additions & 2 deletions

File tree

pyipmi/session.py

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,11 +107,18 @@ def set_auth_type_user(self, username, password):
107107

108108
@property
109109
def auth_username(self):
110-
return self._auth_username
110+
return self._escape_dollar_sign(self._auth_username)
111111

112112
@property
113113
def auth_password(self):
114-
return self._auth_password
114+
return self._escape_dollar_sign(self._auth_password)
115+
116+
def _escape_dollar_sign(self, password):
117+
"""Escape string with dollar sign in ipmitool."""
118+
# The IPMI command is built and executed in a shell using Popen.
119+
# The '$_' combination has its own behavior in shell and it gets
120+
# replaced in the string.
121+
return password.replace('$', '\$')
115122

116123
def establish(self):
117124
if hasattr(self.interface, 'establish_session'):

0 commit comments

Comments
 (0)