Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get rid of potential temp file vulnerability #4

Merged
merged 3 commits into from
Apr 15, 2021
Merged

Get rid of potential temp file vulnerability #4

merged 3 commits into from
Apr 15, 2021

Conversation

ThomasKaiser
Copy link
Contributor

Also address https://github.com/koalaman/shellcheck/wiki/SC2086 in curl call

There's no need for the use of a temporary file at all since all variables are already exported. So better get rid of it since it helps avoiding temp file vulnerabilities and of course also speeds it up a little.

Makes it easier to debug parametrisation errors and transmission failures.
@filipnet filipnet merged commit b5bc825 into filipnet:main Apr 15, 2021
@filipnet
Copy link
Owner

Hello, these are really useful and valuable additions. I will be glad to add them to the repository. Just tested the code adjustments in my Check_MK instance, works fine too. Thank you very much for your contribution and kind regards

@ThomasKaiser ThomasKaiser deleted the patch-1 branch April 16, 2021 06:45
@ThomasKaiser
Copy link
Contributor Author

BTW: our local script copy now looks like this since I've been experimenting quite a bit with the message templates and ran into encoding troubles:

# transform specific strings to lower case
WHAT="$(tr '[:upper:]' '[:lower:]' <<<"${NOTIFY_WHAT}")"
NOTIFICATIONTYPE="$(tr '[:upper:]' '[:lower:]' <<<"${NOTIFY_NOTIFICATIONTYPE}")"

# message templates for service notification:
SERVICE_MESSAGE="${WHAT} ${NOTIFICATIONTYPE} with ${NOTIFY_HOSTNAME}/${NOTIFY_SERVICEDESC}: ${NOTIFY_PREVIOUSSERVICEHARDSHORTSTATE} -> ${NOTIFY_SERVICESHORTSTATE}

${NOTIFY_SERVICEOUTPUT}

${NOTIFY_SHORTDATETIME}"

# message templates for host notification:
HOST_MESSAGE="${WHAT} ${NOTIFICATIONTYPE} on ${NOTIFY_HOSTNAME} (${NOTIFY_HOSTADDRESS}): ${NOTIFY_PREVIOUSHOSTHARDSHORTSTATE} -> ${NOTIFY_HOSTSHORTSTATE}

${NOTIFY_HOSTOUTPUT}

${NOTIFY_SHORTDATETIME}"

# Create an URL encoded MESSAGE variable to avoid curl problems
if [[ ${NOTIFY_WHAT} == "SERVICE" ]]; then
        MESSAGE="$(perl -ple 's|([^\w=\-:@])|sprintf( "%%%02x", ord( $1))|ge' <<<"${SERVICE_MESSAGE}")"
else
        MESSAGE="$(perl -ple 's|([^\w=\-:@])|sprintf( "%%%02x", ord( $1))|ge' <<<"${HOST_MESSAGE}")"
fi

Still testing (waiting for some switch port CRIT events). If we've finished testing I'll have a look whether I get this URL encoding stuff running with python to minimise external dependencies and might send then another PR.

Cheers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants