mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-02 22:00:19 +00:00
Replace unsafe '$var' bash string interpolation inside Python code with
sys.argv parameter passing across 9 cloud provider libs. This eliminates
a class of potential injection bugs where values containing single quotes
could break the Python string context.
Affected functions:
- binarylane: _binarylane_build_server_body
- contabo: _contabo_build_instance_body
- digitalocean: _build_droplet_request_body
- hostinger: _hostinger_build_create_body
- ionos: ionos_register_ssh_key, _ionos_create_datacenter,
_ionos_build_volume_body, _ionos_build_server_body
- linode: _linode_build_create_payload
- ovh: ovh_register_ssh_key, _ovh_find_flavor_id,
_ovh_get_ssh_key_id, _ovh_build_instance_body
- upcloud: _build_upcloud_server_body
- vultr: _vultr_build_instance_body
This aligns with the pattern already used by cherry, scaleway, netcup,
and ramnode providers.
Agent: complexity-hunter
Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| common.sh | ||