"Delete Protection" is not honored when clean up an account or a domain

[weizhouapache]

problem

As title.

Steps to reproduce the issue:

• Create a VM

• Edit the VM and enable “Delete Protection”

• Delete the VM, got an error as expected:

• Disable the account → the VM is stopped, and Delete Protection remains enabled

• Delete the account → the VM is expunged

**Expected behavior: The VM should not be deleted when Delete Protection is enabled.

The same issue also occurs when cleaning up a domain.**

versions

ACS 4.22
(4.20.2 is also impacted)

The steps to reproduce the bug

...

What to do about it?

No response

[daviftorres]

Dear @weizhouapache, I guess this issue will require refactoring cleanupDomain.

It apparently mixed up what is character scaping in the path with the % used to wrap a MySQL LIKE.

cloudstack/server/src/main/java/com/cloud/user/DomainManagerImpl.java

Line 633 in 5d61ba3

sc1.addAnd("path", SearchCriteria.Op.LIKE, "%" + "replace(" + domainHandle.getPath() + ", '%', '[%]')" + "%");

[weizhouapache]

Dear @weizhouapache, I guess this issue will require refactoring cleanupDomain.

It apparently mixed up what is character scaping in the path with the % used to wrap a MySQL LIKE.

cloudstack/server/src/main/java/com/cloud/user/DomainManagerImpl.java

Line 633 in 5d61ba3

sc1.addAnd("path", SearchCriteria.Op.LIKE, "%" + "replace(" + domainHandle.getPath() + ", '%', '[%]')" + "%");

Hi @daviftorres
have you faced an issue which seems to be caused by the line you mentioned ?

the issue with "Delete Protection" seems unrelated to it.

[daviftorres]

Dear @weizhouapache, I guess this issue will require refactoring cleanupDomain.
It apparently mixed up what is character scaping in the path with the % used to wrap a MySQL LIKE.
cloudstack/server/src/main/java/com/cloud/user/DomainManagerImpl.java
Line 633 in 5d61ba3
sc1.addAnd("path", SearchCriteria.Op.LIKE, "%" + "replace(" + domainHandle.getPath() + ", '%', '[%]')" + "%");

Hi @daviftorres have you faced an issue which seems to be caused by the line you mentioned ?

the issue with "Delete Protection" seems unrelated to it.

Dear @weizhouapache,

Sorry if I gave the wrong impression. No, I haven’t encountered any issue caused by this part of the code.

Actually, I’ve been reviewing this section over the past few days, trying to find a possible exploit, when I came across your issue.

Regards,

[DaanHoogland]

fixed in #12901