fix: use shlex.split() in nagios_runner path validation to handle quoted paths

2026-04-25 16:28:32 +02:00
parent 535dbda47d
commit d7e6b478e1
1 changed files with 8 additions and 1 deletions
@@ -24,6 +24,7 @@ nagios_runner:
 import asyncio
 import os
 import re
+import shlex
 from typing import Any, Dict, List, Optional, Tuple

 from hbd.client.plugin import MonitorPlugin
@@ -101,7 +102,13 @@ class NagiosRunnerPlugin(MonitorPlugin):
            command = cmd_config.get("command", "")
            if not command:
                continue
-            exe = command.split()[0]
+            try:
+                tokens = shlex.split(command)
+            except ValueError:
+                continue  # malformed command string; skip validation
+            if not tokens:
+                continue
+            exe = tokens[0]
            if os.path.isabs(exe):
                if not os.path.isfile(exe):
                    self.logger.warning(