daviftorres commented on issue #12895: URL: https://github.com/apache/cloudstack/issues/12895#issuecomment-4169370463
> > Dear [@weizhouapache](https://github.com/weizhouapache), I guess this issue will require refactoring `cleanupDomain`. > > It apparently mixed up what is character scaping in the path with the `%` used to wrap a MySQL LIKE. > > [cloudstack/server/src/main/java/com/cloud/user/DomainManagerImpl.java](https://github.com/apache/cloudstack/blob/5d61ba353839efdf74ec71352a4c0ec833d9daf9/server/src/main/java/com/cloud/user/DomainManagerImpl.java#L633) > > Line 633 in [5d61ba3](/apache/cloudstack/commit/5d61ba353839efdf74ec71352a4c0ec833d9daf9) > > sc1.addAnd("path", SearchCriteria.Op.LIKE, "%" + "replace(" + domainHandle.getPath() + ", '%', '[%]')" + "%"); > > Hi [@daviftorres](https://github.com/daviftorres) have you faced an issue which seems to be caused by the line you mentioned ? > > the issue with "Delete Protection" seems unrelated to it. Dear @weizhouapache, Sorry if I gave the wrong impression. No, I haven’t encountered any issue caused by this part of the code. Actually, I’ve been reviewing this section over the past few days, trying to find a possible exploit, when I came across your issue. Regards, -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
