Changeset 106439 in vbox for trunk/src/VBox

Timestamp:

Oct 17, 2024 11:50:35 AM (6 weeks ago)

Author:

vboxsync

Message:

FE/Qt: bugref:10786 Sanitize file object names.

Location:

trunk/src/VBox

Files:

• Frontends/VirtualBox/src/medium/viso/UIVisoContentBrowser.cpp (modified) (1 diff)
• Frontends/VirtualBox/src/medium/viso/UIVisoCreator.cpp (modified) (1 diff)
• Main/src-server/UnattendedInstaller.cpp (modified) (1 diff)

trunk/src/VBox/Frontends/VirtualBox/src/medium/viso/UIVisoContentBrowser.cpp

@@ -429 +429 @@
         if (iterator.value().isEmpty())
             continue;
-        QString strEntry = QString("%1=%2").arg(iterator.key()).arg(iterator.value());
+        QString strSource = iterator.key();
+        strSource.replace("\"", "\\\"");
+        QString strTarget = iterator.value();
+        strTarget.replace("\"", "\\\"");
+        /* We must quote %1 and %2 here, as those might contain spaces as part of a path or file name. */
+        QString strEntry = QString("\"%1\"=\"%2\"").arg(strSource).arg(strTarget);
         entryList << strEntry;
     }

trunk/src/VBox/Frontends/VirtualBox/src/medium/viso/UIVisoCreator.cpp

@@ -985 +985 @@
         QTextStream stream(&file);
         stream << QString("%1 %2").arg("--iprt-iso-maker-file-marker-bourne-sh").arg(QUuid::createUuid().toString()) << "\n";
-        stream<< "--volume-id=" << strVisoName << "\n";
+        /* Note: Quote the volume ID, as we might use the VM name as a default, which in turn can contain spaces. */
+        stream<< "--volume-id=\"" << strVisoName << "\"\n";
         if (!strImportedISOPath.isEmpty())
             stream << "--import-iso=" << strImportedISOPath << "\n";

trunk/src/VBox/Main/src-server/UnattendedInstaller.cpp

@@ -1506 +1506 @@
          *        One less CDROM to mount. */
         /* Name the ISO. */
-        rVecArgs.append() = "--volume-id=VBox Unattended Boot";
+        rVecArgs.append() = "--volume-id=\"VBox Unattended Boot\"";
 
         /* Copy the isolinux directory from the original install ISO. */