Potential bug in illegal character extraction from macros in 2.0b1 (no fix).

[Stanley Hopcroft]

Dear Folks,

I am writing to report a potential bug in macro processing in 2.0b1.

Macros do not appear to have illegal chars stripped.

Background:

Notifications failed - occasionally - for a  partic check.
Enabled DEBUG4 on a test bed with these results 

SERVICE NOTIFICATION ATTEMPT: Service 'Patent Search' on host 'asterix'
        Type: 0
        Current time: Wed Feb  2 22:07:01 2005
        Current notification number: 1
        Service notification will NOT be escalated
        Notify user unix

        Raw Command:       /usr/bin/printf "%b" "$SERVICEDESC$ 
$HOSTNAME$ $SERVICESTATE$ $SHORTDATETIME$ $SERVICEOUTPUT$" | tee -a 
/usr/home/anwsmh/nagios-2.0b1/var/notify_prob.log | /usr/bin/head -c 160 
| /usr/bin/mail $CONTACTPAGER$

        Processed Command: /usr/bin/printf "%b" "Patent Search asterix 
CRITICAL 02-02-2005 22:07:01 Patent Searching. Error indication in 
response: "GET 
http://asterix:7003/searching/patsearch/search_page.jsp?keyNo=&name=SMITH&applicants=T" 
Transaction failed: fault indication in response.  No records were found 
that matched your selection criteria</font></b></td>         </tr>" | 
tee -a /usr/home/anwsmh/nagios-2.0b1/var/notify_prob.log | /usr/bin/head 
-c 160 | /usr/bin/mail unix.page

        Notify user foo

        Raw Command:       /usr/bin/printf "%b" "***** Nagios 2.0 
*****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: 
$SERVICEDESC$\nHost: $HOSTNAME$\nAddress: $HOSTADDRESS$\nState: 
$SERVICESTATE$\n\nDate/Time: $SHORTDATETIME$\n\nAdditional 
Info:\n\n$SERVICEOUTPUT$" | tee -a 
/usr/home/anwsmh/nagios-2.0b1/var/notify_prob.log | /usr/bin/mail -s "** 
$NOTIFICATIONTYPE$ alert - $HOSTNAME$/$SERVICEDESC$ is $SERVICESTATE$ 
**" $CONTACTEMAIL$

        Processed Command: /usr/bin/printf "%b" "***** Nagios 2.0 
*****\n\nNotification Type: PROBLEM\n\nService: Patent Search\nHost: 
asterix\nAddress: 10.0.100.202\nState: CRITICAL\n\nDate/Time: 02-02-2005 
22:07:01\n\nAdditional Info:\n\nPatent Searching. Error indication in 
response: "GET 
http://asterix:7003/searching/patsearch/search_page.jsp?keyNo=&name=SMITH&applicants=T" 
Transaction failed: fault indication in response.  No records were found 
that matched your selection criteria</font></b></td>         </tr>" | 
tee -a /usr/home/anwsmh/nagios-2.0b1/var/notify_prob.log | /usr/bin/mail 
-s "** PROBLEM alert - asterix/Patent Search is CRITICAL **" 
foo at IPAustralia.gov.au

The $SERVICEOUTPUT$ macro contains HTML tags ( </b> and friends ) that 
play merry hell with the shell commands that are forked to deliver the 
notification.

But I would have thought these chars would have been stripped by

# ILLEGAL MACRO OUTPUT CHARACTERS
# This option allows you to specify illegal characters that are
# stripped from macros before being used in notifications, event
# handlers, etc.  This DOES NOT affect macros used in service or
# host check commands.
# The following macros are stripped of the characters you specify:
#       $HOSTOUTPUT$
#       $HOSTPERFDATA$
#       $HOSTACKAUTHOR$
#       $HOSTACKCOMMENT$
#       $SERVICEOUTPUT$
#       $SERVICEPERFDATA$
#       $SERVICEACKAUTHOR$
#       $SERVICEACKCOMMENT$

illegal_macro_output_chars=`~$&|'"<>


Yours sincerely.


-- 
Stanley Hopcroft

IP Australia
Ph: (02) 6283 3189  Fax: (02) 6281 1353
PO Box 200 Woden  ACT 2606
http://www.ipaustralia.gov.au
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: disclaimer.txt
URL: <https://www.monitoring-lists.org/archive/users/attachments/20050202/657c0fb8/attachment.txt>