Special shell characters are interpreted in path to the boot ISO image

[marmarek]

Qubes OS version:

R4.0

Affected component(s) or functionality:

core

---

Steps to reproduce the behavior:

1. Select "Boot qube from CDROM", or execute qubes-vm-boot-from-device.
2. Choose to use a file from another qube.
3. Select a file containing special shell characters, like $, or `.
4. Boot.

Expected or desired behavior:

Filename is used literally, no special characters are interpreted.

Actual behavior:

Special characters are interpreted by shell in the VM where the file is stored. This include possible command execution with `.

General notes:

The problem is in two places:

1. The GUI for choosing the file fails to reject potentially harmful file names (there is a code for that, but it's buggy).
2. qvm-start tool fails to properly escape/quote file name given in --cdrom argument, when sending it back to originating VM (losetup command call).

Reported by @v6ak

I am aware of the following related, non-duplicate issues:

#4850 would avoid the second problem

[qubesos-bot]

Automated announcement from builder-github

The package qubes-manager-4.0.29-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-admin-client has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-qubesadmin-4.0.25-0.1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-admin-client_4.0.25-1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-admin-client has been pushed to the r4.0 stable repository for the CentOS centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-qubesadmin-4.0.25-0.1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-admin-client_4.0.25-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-manager-4.0.33-1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update