NagiosEnterprises / nrpe

NRPE Agent
GNU General Public License v2.0
259 stars 133 forks source link

Commands containing unescaped $ characters are silently broken #196

Open wferi opened 6 years ago

wferi commented 6 years ago

Suppose I forget to escape the $ sign in the following command definition:

command[dollar]=echo '$'

The NRPE server still starts up without any complaint, but runs the wrong command:

./check_nrpe -H localhost -c dollar
$$

strace reveals that the shell command actually run by the server is echo '$'$, which apparently has an extra $ sign added to its end. Some debugging points out that it's added by the process_macros function: raw_command contains the correct command, but processed_command gains a closing $ sign.

https://github.com/NagiosEnterprises/nrpe/blob/56492da4e4b55c8d188ed8114a88c18f0250ff55/src/nrpe.c#L1768

I think the NRPE server shouldn't start such mangled commands. It isn't obvious why it should care about $ signs at all with dont_blame_nrpe=0, but if it does, a clear error message would be preferable.