A 3c3c697ea5 fix: json_escape SSH key names and fix GCP metadata injection (#958) ... SSH key registration in 11 cloud providers used unescaped key_name directly in JSON request bodies. If the hostname (used to generate key names) contained JSON-special characters like double-quotes, it could break out of the JSON string and inject arbitrary JSON fields. Fix: use json_escape for key_name in all providers, matching the pattern already used by Scaleway. Also fix GCP create_server which embedded the startup script inline in --metadata with comma delimiters. Commas in the script could break metadata parsing or inject additional metadata keys. Fix: use --metadata-from-file for the startup script. Affected providers: Hetzner, DigitalOcean, Vultr, BinaryLane, Hostinger, Contabo, Cherry, HOSTKEY, Civo, Linode, Genesis Cloud, GCP. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-02-13 09:03:35 -08:00
..
common.sh	fix: json_escape SSH key names and fix GCP metadata injection (#958)	2026-02-13 09:03:35 -08:00