gsadmin/PSProxmoxVE
1
0
Fork 0
mirror of https://github.com/GoodOlClint/PSProxmoxVE.git synced 2026-08-19 09:26:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: deliver Invoke-PveVmGuestExec -Args to the guest as argv

Browse Source 
ExecuteGuestCommand JSON-serialized the args array into the agent/exec
'input-data' field — which is the process's STDIN, not its arguments. So
guest commands ran with no argv: cmd.exe started interactively and the
JSON blob ['/c','echo',...] arrived at its prompt.

PVE's agent/exec 'command' parameter is itself an array (element 0 = the
executable, the rest = argv) sent as repeated form keys. The low-level
client couldn't express repeated keys (Dictionary<string,string> only),
so:

- Add PostAsync(string, IEnumerable<KeyValuePair<string,string>>) to
  IPveHttpClient/PveHttpClient; BuildFormContent now emits one key=value
  field per pair, so a key may repeat.
- ExecuteGuestCommand builds command = [exe] + args as repeated 'command'
  fields and no longer touches input-data.

Tests: form-encoder repeated-key + per-value encoding cases; VmService
tests asserting the command array, order, and absence of input-data; an
integration regression guard that echoes an arg and checks it round-trips
as stdout.

Tracked as F091. Closes #68.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Clint Branham
2026-05-22 14:32:04 -05:00
parent 5266accfae
commit bc71ed4a12
7 changed files with 199 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/review/findings.json
+32
View File
@@ -2971,6 +2971,38 @@
"evidence": "Added typed scsihw/efidisk0/tpmstate0 properties plus a private [JsonExtensionData] landing field exposed as AdditionalProperties (Dictionary<string, object?> via JsonHelper.ToNative, so values are native .NET types per D013 — no JToken leakage). Typed keys do not duplicate into the catch-all.",
"verified_by": "dotnet build + dotnet test (586 passed, new VmModelTests for scsihw/efidisk/tpm, native-typed AdditionalProperties, and no typed-key leakage)"
}
},
{
"id": "F091",
"title": "Invoke-PveVmGuestExec -Args delivered as JSON STDIN instead of argv",
"category": "api_contract",
"severity": "high",
"status": "resolved",
"first_detected": "2026-05-22",
"github_issue": 68,
"files": [
"src/PSProxmoxVE.Core/Services/VmService.cs",
"src/PSProxmoxVE.Core/Client/PveHttpClient.cs",
"src/PSProxmoxVE.Core/Client/IPveHttpClient.cs"
],
"description": "VmService.ExecuteGuestCommand JSON-serialized the args array into the agent/exec 'input-data' field (the process's STDIN) instead of passing them as argv. PVE's agent/exec 'command' parameter is itself an array (element 0 = executable, rest = arguments) and must be sent as repeated form keys. The result: guest commands ran with no/garbage arguments (cmd.exe started interactively, the JSON blob appeared at the prompt). The low-level client also could not express repeated form keys (Dictionary<string,string> only).",
"scan_history": [
{
"scan_date": "2026-05-22",
"local_id": null,
"status": "new"
},
{
"scan_date": "2026-05-22",
"local_id": null,
"status": "fixed"
}
],
"resolution": {
"scan_date": "2026-05-22",
"evidence": "Added PostAsync(string, IEnumerable<KeyValuePair<string,string>>) to IPveHttpClient/PveHttpClient (BuildFormContent now emits repeated keys). ExecuteGuestCommand builds command = [exe] + args as repeated 'command' fields and no longer touches input-data.",
"verified_by": "dotnet build (0 warnings) + dotnet test (594 passed; new PveHttpClientFormEncodingTests for repeated keys + per-value encoding, and VmServiceTests asserting the command array and absence of input-data)"
}
}
]
}