{"action":"created","issue":{"url":"https://api.github.com/repos/HubSpot/Singularity/issues/1406","repository_url":"https://api.github.com/repos/HubSpot/Singularity","labels_url":"https://api.github.com/repos/HubSpot/Singularity/issues/1406/labels{/name}","comments_url":"https://api.github.com/repos/HubSpot/Singularity/issues/1406/comments","events_url":"https://api.github.com/repos/HubSpot/Singularity/issues/1406/events","html_url":"https://github.com/HubSpot/Singularity/issues/1406","id":203194698,"number":1406,"title":"Deploy id character blacklist needs expanding","user":{"login":"nyarly","id":127548,"avatar_url":"https://avatars.githubusercontent.com/u/127548?v=3","gravatar_id":"","url":"https://api.github.com/users/nyarly","html_url":"https://github.com/nyarly","followers_url":"https://api.github.com/users/nyarly/followers","following_url":"https://api.github.com/users/nyarly/following{/other_user}","gists_url":"https://api.github.com/users/nyarly/gists{/gist_id}","starred_url":"https://api.github.com/users/nyarly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nyarly/subscriptions","organizations_url":"https://api.github.com/users/nyarly/orgs","repos_url":"https://api.github.com/users/nyarly/repos","events_url":"https://api.github.com/users/nyarly/events{/privacy}","received_events_url":"https://api.github.com/users/nyarly/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-01-25T19:12:37Z","updated_at":"2017-01-25T21:24:56Z","closed_at":null,"body":"Experimenting with Deploy ids and redeploys (specifically, I was looking for a delimiter to use in machine-generated deploy ids), I found that a Deploy id that Singulary's API accepted still crashed the Executor:\r\n\r\nFailed to launch container: Failed to create container: Failed to chown: Failed to execute 'chown -R 0:0 '/mnt/mesos-slave/slaves/f38ff857-4831-46dc-b143-d8aaa0c44d06-S0/frameworks/Singularity/executors/github.com>opentable>sous-demo::ci-sf-<>|=()'_+{}\"^&df1d7456ac654e4097ae451b0dc6c0fa-1485370286019-1-[REDACTED]-FIXME/runs/9967afcc-0feb-4421-baa7-094d6d8896fb'' (exit status: 512): Success; Abnormal executor termination\r\n\r\nI'm concerned further that one explanation for this problem is that the `'` ends the chown command, and the shell treats the rest as garbage. (I can only guess here: it *looks* like exec(commandString) rather than exec([array, of, command, parts])). If that's the case, there's the possibility of an RCE against Mesos agents for anyone with access to Singularity. It's tricky to test for this, because the ` ` restriction limits us to single word commands... like `halt`."},"comment":{"url":"https://api.github.com/repos/HubSpot/Singularity/issues/comments/275237443","html_url":"https://github.com/HubSpot/Singularity/issues/1406#issuecomment-275237443","issue_url":"https://api.github.com/repos/HubSpot/Singularity/issues/1406","id":275237443,"user":{"login":"nyarly","id":127548,"avatar_url":"https://avatars.githubusercontent.com/u/127548?v=3","gravatar_id":"","url":"https://api.github.com/users/nyarly","html_url":"https://github.com/nyarly","followers_url":"https://api.github.com/users/nyarly/followers","following_url":"https://api.github.com/users/nyarly/following{/other_user}","gists_url":"https://api.github.com/users/nyarly/gists{/gist_id}","starred_url":"https://api.github.com/users/nyarly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nyarly/subscriptions","organizations_url":"https://api.github.com/users/nyarly/orgs","repos_url":"https://api.github.com/users/nyarly/repos","events_url":"https://api.github.com/users/nyarly/events{/privacy}","received_events_url":"https://api.github.com/users/nyarly/received_events","type":"User","site_admin":false},"created_at":"2017-01-25T21:24:56Z","updated_at":"2017-01-25T21:24:56Z","body":"HYG: \r\n\r\n``` <button data-clipboard-text=\"{\r\n  &quot;deployResult&quot;: {\r\n    &quot;deployState&quot;: &quot;SUCCEEDED&quot;,\r\n    &quot;deployFailures&quot;: [],\r\n    &quot;timestamp&quot;: 1485370424344\r\n  },\r\n  &quot;deployMarker&quot;: {\r\n    &quot;requestId&quot;: &quot;github.com>opentable>sous-demo::ci-sf&quot;,\r\n    &quot;deployId&quot;: &quot;=()_+{}df1d7456ac654e4097ae451b0dc6c0fa&quot;,\r\n    &quot;timestamp&quot;: 1485370361173,\r\n    &quot;user&quot;: &quot;asdf&quot;\r\n  },\r\n  &quot;deploy&quot;: {\r\n    &quot;requestId&quot;: &quot;github.com>opentable>sous-demo::ci-sf&quot;,\r\n    &quot;id&quot;: &quot;=()_+{}df1d7456ac654e4097ae451b0dc6c0fa&quot;,\r\n    &quot;containerInfo&quot;: {\r\n      &quot;type&quot;: &quot;DOCKER&quot;,\r\n      &quot;volumes&quot;: [],\r\n      &quot;docker&quot;: {\r\n        &quot;image&quot;: &quot;docker.otenv.com/sous-demo@sha256:c3b52e949485ee90108223d32317854495df7892c7e7776664be3bbd0e104f85&quot;,\r\n        &quot;privileged&quot;: false,\r\n        &quot;network&quot;: &quot;BRIDGE&quot;,\r\n        &quot;portMappings&quot;: [],\r\n        &quot;forcePullImage&quot;: false,\r\n        &quot;dockerParameters&quot;: []\r\n      }\r\n    },\r\n    &quot;resources&quot;: {\r\n      &quot;cpus&quot;: 0.1,\r\n      &quot;memoryMb&quot;: 10,\r\n      &quot;numPorts&quot;: 1,\r\n      &quot;diskMb&quot;: 0\r\n    },\r\n    &quot;env&quot;: {\r\n      &quot;OT_DISCO_INIT_URL&quot;: &quot;discovery-ci-sf.otenv.com&quot;,\r\n      &quot;OT_ENV&quot;: &quot;ci-sf&quot;\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n(sorry about the HTML entities: the Copy button does not work for whatever reason, so this is C&P'd from the SPA.)"}}
{"actor":{"display_login":"nyarly"}}