BUG/MEDIUM: runtime: reject special characters in filenames

Avoid command injection when calling the runtime API by rejecting
dangerous characters which should never be used in filenames.

The rejected characters: \r\n<>*;$#&{}"

Note that we cannot simply add quotes around arguments in runtime
commands since HAProxy does not parse them, unlike in the configuration
file.

Author: oliwer

runtime/runtime_single_client.go

@@ -33,6 +33,8 @@ const (
 	masterSocket socketType = "master"
 )
 
+var ErrRuntimeInvalidChar = errors.New("invalid character found in runtime command")
+
 type socketType string
 
 // SingleRuntime handles one runtime API
@@ -180,6 +182,10 @@ func (s *SingleRuntime) ExecuteMaster(command string) (string, error) {
 }
 
 func (s *SingleRuntime) executeRaw(command string, retry int, socket socketType) (string, error) {
+	// Make sure to only execute a single command.
+	if strings.ContainsAny(command, ";") {
+		return "", ErrRuntimeInvalidChar
+	}
 	result, err := s.readFromSocket(command, socket)
 	if err != nil && retry > 0 {
 		retry--

runtime/runtime_single_client_test.go

@@ -0,0 +1,46 @@
+// Copyright 2026 HAProxy Technologies
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package runtime_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/haproxytech/client-native/v6/runtime"
+)
+
+func TestSingleRuntime_Execute(t *testing.T) {
+	tests := []struct {
+		name    string // description of this test case
+		command string
+		wantErr error
+	}{
+		{
+			name:    "two commands with semicolon",
+			command: "show ssl cert foo;dump ssl foo",
+			wantErr: runtime.ErrRuntimeInvalidChar,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var s runtime.SingleRuntime
+			gotErr := s.Execute(tt.command)
+			if !errors.Is(gotErr, tt.wantErr) {
+				t.Errorf("got %v, expected %v", gotErr, tt.wantErr)
+			}
+		})
+	}
+}

specification/build/haproxy_spec.yaml

@@ -12204,6 +12204,7 @@ parameters:
     description: Parent name
     required: true
     type: string
+    pattern: '^[^\r\n<>*;$#&{}"]+$'
   full_section:
     name: full_section
     in: query
@@ -25597,6 +25598,7 @@ paths:
         - description: ACL file entry ID
           in: path
           name: id
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -25689,6 +25691,7 @@ paths:
         - description: File entry ID
           in: path
           name: id
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -25712,6 +25715,7 @@ paths:
         - description: File entry ID
           in: path
           name: id
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -25796,6 +25800,7 @@ paths:
         - description: Server name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -25818,6 +25823,7 @@ paths:
         - description: Server name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -25840,6 +25846,7 @@ paths:
         - description: Server name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -25912,6 +25919,7 @@ paths:
         - description: SSL CA file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       responses:
@@ -25931,6 +25939,7 @@ paths:
         - description: SSL CA file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -25956,6 +25965,7 @@ paths:
         - description: SSL CA file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - in: formData
@@ -25983,6 +25993,7 @@ paths:
         - description: SSL CA file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: Payload of the cert entry
@@ -26013,6 +26024,7 @@ paths:
         - description: SSL CA file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: SSL CA file index
@@ -26085,6 +26097,7 @@ paths:
         - description: SSL certificate name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       responses:
@@ -26104,6 +26117,7 @@ paths:
         - description: SSL certificate name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -26127,6 +26141,7 @@ paths:
         - description: SSL certificate name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - in: formData
@@ -26194,6 +26209,7 @@ paths:
         - description: CRL file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       responses:
@@ -26213,6 +26229,7 @@ paths:
         - description: CRL file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: Entry index to return. Starts at 1. If not provided, all entries are returned.
@@ -26244,6 +26261,7 @@ paths:
         - description: CRL file name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: CRL file contents
@@ -26286,11 +26304,13 @@ paths:
         - description: SSL crt list name
           in: query
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: SSL cert entry name
           in: query
           name: cert_file
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - description: The line number where the entry is located, in case several entries share the same certificate.
@@ -26318,6 +26338,7 @@ paths:
         - description: SSL crt-list filename
           in: query
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       produces:
@@ -26339,6 +26360,7 @@ paths:
         - description: SSL crt-list filename
           in: query
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
         - in: body
@@ -26382,6 +26404,7 @@ paths:
         - description: Stick table name
           in: path
           name: name
+          pattern: ^[^\r\n<>*;$#&{}"]+$
           required: true
           type: string
       responses:
@@ -26405,10 +26428,12 @@ paths:
         - description: A list of filters in format data.<type> <operator> <value> separated by comma
           in: query
           name: filter
+          pattern: ^[^\r\n;#]+$
           type: string
         - description: Key which we want the entries for
           in: query
           name: key
+          pattern: ^[^\r\n;#]+$
           type: string
         - description: Max number of entries to be returned for pagination
           in: query
@@ -26441,6 +26466,7 @@ paths:
               data_type:
                 $ref: '#/definitions/stick_table_entry'
               key:
+                pattern: ^[^\r\n;#]+$
                 type: string
             required:
               - key
@@ -26485,6 +26511,7 @@ paths:
         - description: Map file name
           in: path
           name: name
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
         - description: If true, deletes file from disk
@@ -26513,6 +26540,7 @@ paths:
         - description: Map file name
           in: path
           name: name
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
       responses:
@@ -26534,6 +26562,7 @@ paths:
         - description: Map file name
           in: path
           name: name
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
         - default: false
@@ -26613,6 +26642,7 @@ paths:
         - description: Map id
           in: path
           name: id
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -26638,6 +26668,7 @@ paths:
         - description: Map id
           in: path
           name: id
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -26660,6 +26691,7 @@ paths:
         - description: Map id
           in: path
           name: id
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
         - $ref: '#/parameters/parent_name'
@@ -26716,6 +26748,7 @@ paths:
         - description: Certificate file name
           in: query
           name: certificate
+          pattern: ^[^\r\n&lt;>*;$#&{}"]+$
           required: true
           type: string
       responses:

specification/haproxy-spec.yaml

@@ -830,6 +830,7 @@ parameters:
     description: Parent name
     required: true
     type: string
+    pattern: '^[^\r\n<>*;$#&{}"]+$'
   full_section:
     name: full_section
     in: query

specification/paths/runtime/acls.yaml

@@ -28,6 +28,7 @@ acls_one:
         description: ACL file entry ID
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
     responses:
       '200':
         description: Successful operation

specification/paths/runtime/acls_entries.yaml

@@ -14,6 +14,7 @@ acls_entries_one:
         description: File entry ID
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
     responses:
       '200':
         description: Successful operation
@@ -39,6 +40,7 @@ acls_entries_one:
         description: File entry ID
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
     responses:
       '204':
         description: Successful operation

specification/paths/runtime/acme.yaml

@@ -26,6 +26,7 @@ acme:
         description: Certificate file name
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
     responses:
       '200':
         description: Operation started

specification/paths/runtime/maps.yaml

@@ -35,6 +35,7 @@ maps_one:
         description: Map file name
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
     responses:
       '200':
         description: Successful operation
@@ -54,6 +55,7 @@ maps_one:
         description: Map file name
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
       - name: forceDelete
         in: query
         description: If true, deletes file from disk
@@ -82,6 +84,7 @@ maps_one:
         description: Map file name
         required: true
         type: string
+        pattern: '^[^\r\n<>*;$#&{}"]+$'
       - name: force_sync
         in: query
         description: If true, immediately syncs changes to disk