Merge remote-tracking branch 'origin/4.22' into fix/nasbackup-enhancements-combined

Signed-off-by: James Peru <jmsperu@gmail.com>

# Conflicts:
#	plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java
#	plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapperTest.java

Author: jmsperu

.github/workflows/ci.yml

@@ -282,7 +282,7 @@ jobs:
           # https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2004-Readme.md#mysql
           sudo apt-get install -y mysql-server
           sudo systemctl start mysql
-          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY ''; FLUSH PRIVILEGES;"
+          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY ''; FLUSH PRIVILEGES;"
           sudo systemctl restart mysql
           sudo mysql -uroot -e "SELECT VERSION();"
 

agent/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

api/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

api/src/main/java/org/apache/cloudstack/acl/APIChecker.java

@@ -17,16 +17,22 @@
 package org.apache.cloudstack.acl;
 
 import com.cloud.exception.PermissionDeniedException;
+import com.cloud.exception.RequestLimitException;
 import com.cloud.user.Account;
 import com.cloud.user.User;
 import com.cloud.utils.component.Adapter;
 
+import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 /**
  * APICheckers is designed to verify the ownership of resources and to control the access to APIs.
  */
 public interface APIChecker extends Adapter {
+    Logger LOGGER = LogManager.getLogger(APIChecker.class);
     // Interface for checking access for a role using apiname
     // If true, apiChecker has checked the operation
     // If false, apiChecker is unable to handle the operation or not implemented
@@ -42,5 +48,27 @@ public interface APIChecker extends Adapter {
      * @return the list of allowed apis for the given user
      */
     List<String> getApisAllowedToUser(Role role, User user, List<String> apiNames) throws PermissionDeniedException;
+
+    default List<String> getApisAllowedToAccount(Account account, List<String> apiNames) {
+        List<String> allowedApis = new ArrayList<>();
+        for (String apiName : apiNames) {
+            try {
+                checkAccess(account, apiName);
+                allowedApis.add(apiName);
+            } catch (RequestLimitException e) {
+                // Non-ACL failure (e.g. rate limiting) should not be treated as simple "not allowed".
+                // Propagate as unchecked so callers are aware of the failure.
+                throw new RuntimeException("Failed to check access for API [" + apiName + "] due to request limits", e);
+            } catch (PermissionDeniedException e) {
+                LOGGER.trace("Account [" + account + "] is not allowed to access API [" + apiName + "]");
+            }
+        }
+        return allowedApis;
+    }
+
     boolean isEnabled();
+
+    default void refreshRoleCacheOnPermissionsChange(Role role) {
+        // Only applicable for dynamic role based checkers
+    }
 }

api/src/main/java/org/apache/cloudstack/acl/Rule.java

@@ -25,16 +25,18 @@
 
 public final class Rule {
     private final String rule;
+    private final Pattern compiledPattern;
     private final static Pattern ALLOWED_PATTERN = Pattern.compile("^[a-zA-Z0-9*]+$");
 
     public Rule(final String rule) {
         validate(rule);
         this.rule = rule;
+        this.compiledPattern = Pattern.compile(rule.replace("*", "\\w*"), Pattern.CASE_INSENSITIVE);
     }
 
     public boolean matches(final String commandName) {
         return StringUtils.isNotEmpty(commandName)
-                && commandName.toLowerCase().matches(rule.toLowerCase().replace("*", "\\w*"));
+                && compiledPattern.matcher(commandName).matches();
     }
 
     public String getRuleString() {

api/src/main/java/org/apache/cloudstack/api/ApiArgValidator.java

@@ -17,9 +17,18 @@
 
 package org.apache.cloudstack.api;
 
+import java.util.Locale;
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.UuidUtils;
+
 public enum ApiArgValidator {
     /**
-     * Validates if the parameter is null or empty with the method {@link Strings#isNullOrEmpty(String)}.
+     * Validates if the parameter is null or empty with the method {@link StringUtils#isEmpty(CharSequence)}.
+     * Validation is currently done in the method ParamProcessWorker#validateNonEmptyString(String, String).
      */
     NotNullOrEmpty,
 
@@ -29,12 +38,72 @@ public enum ApiArgValidator {
     PositiveNumber,
 
     /**
-     * Validates if the parameter is an UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validates if the parameter is a UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validation is currently done in the method ParamProcessWorker#validateUuidString(String, String).
      */
     UuidString,
 
     /**
      * Validates if the parameter is a valid RFC Compliance domain name.
      */
     RFCComplianceDomainName,
+
+    /**
+     * Validates command option strings to avoid unsafe/code-like content.
+     */
+    SafeCommandOptions((param, annotation) -> {
+        if (BaseCmd.CommandType.STRING.equals(annotation.type())) {
+            validateSafeCommandOptions(param, annotation.name());
+        }
+    });
+
+    private static final Pattern SAFE_COMMAND_OPTIONS_PATTERN = Pattern.compile("^[A-Za-z0-9,._=:/+\\-\\s]*$");
+
+    private static final String[] UNSAFE_TOKENS = {
+            "$(", "`", "&&", "||", ";", "|", ">", "<"
+    };
+
+    private final ValidationRule rule;
+
+    ApiArgValidator() {
+        this(null);
+    }
+
+    ApiArgValidator(ValidationRule rule) {
+        this.rule = rule;
+    }
+
+    public void validate(final Object paramObj, final Parameter annotation) {
+        if (rule != null) {
+            rule.validate(paramObj, annotation);
+        }
+    }
+
+    private static void validateSafeCommandOptions(final Object param, final String argName) {
+        final String value = String.valueOf(param);
+        if (StringUtils.isBlank(value)) {
+            return;
+        }
+
+        if (!SAFE_COMMAND_OPTIONS_PATTERN.matcher(value).matches()) {
+            throwInvalidParameterValueException(argName, "contains unsupported or unsafe characters");
+        }
+
+        final String normalized = value.toLowerCase(Locale.ROOT);
+        for (String token : UNSAFE_TOKENS) {
+            if (normalized.contains(token)) {
+                throwInvalidParameterValueException(argName, "contains code-like or unsafe content");
+            }
+        }
+    }
+
+    private static void throwInvalidParameterValueException(final String argName, final String customMsg) {
+        throw new InvalidParameterValueException(String.format("Invalid value provided for API arg: %s%s", argName,
+                StringUtils.isBlank(customMsg) ? "" : " - " + customMsg));
+    }
+
+    @FunctionalInterface
+    interface ValidationRule {
+        void validate(Object paramObj, Parameter annotation);
+    }
 }

api/src/main/java/org/apache/cloudstack/api/ApiConstants.java

@@ -1407,7 +1407,7 @@ public String toString() {
     }
 
     public enum HostDetails {
-        all, capacity, events, stats, min;
+        all, capacity, core, events, stats, min;
     }
 
     public enum VMDetails {

api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ResetVMPasswordCmdByAdmin.java

@@ -27,5 +27,5 @@
 @APICommand(name = "resetPasswordForVirtualMachine", responseObject=UserVmResponse.class, description = "Resets the password for Instance. " +
                     "The Instance must be in a \"Stopped\" state and the Template must already " +
         "support this feature for this command to take effect. [async]", responseView = ResponseView.Full, entityType = {VirtualMachine.class},
-        requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
+        requestHasSensitiveInfo = true, responseHasSensitiveInfo = true)
 public class ResetVMPasswordCmdByAdmin extends ResetVMPasswordCmd implements AdminCmd {}

api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java

@@ -22,6 +22,7 @@
 import org.apache.commons.collections.MapUtils;
 
 import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
@@ -106,6 +107,7 @@ public class CreateAutoScaleVmProfileCmd extends BaseAsyncCreateCmd {
             since = "4.18.0")
     private String userData;
 
+    @ACL
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.18.1")
     private Long userDataId;
 

api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/UpdateAutoScaleVmProfileCmd.java

@@ -101,6 +101,7 @@ public class UpdateAutoScaleVmProfileCmd extends BaseAsyncCustomIdCmd {
             since = "4.18.0")
     private String userData;
 
+    @ACL
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the userdata",
             since = "4.18.1")
     private Long userDataId;