[Ignition] Butane template uses text/template with no YAML escaping — potential injection via SSH key comments

[castrojo]

Summary

The Butane YAML template in internal/ignition/ignition.go uses Go's text/template package, which performs zero escaping of interpolated values. User-supplied strings (hostnames, usernames, SSH keys, sysext names) are inserted directly into double-quoted YAML strings without any YAML-safe escaping.

While hostname and username validation prevents most dangerous characters, SSH key comments are not validated for content — only the key type prefix is checked. A crafted SSH key comment containing a double quote could break the YAML structure.

Example

An SSH public key with a crafted comment:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample user"
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvil injected@key

This is a valid SSH key format (passes validate.SSHPublicKey() since it starts with a valid type and has 2+ fields). When templated:

ssh_authorized_keys:
    - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample user"
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvil injected@key"

This could inject additional YAML content. While butane's --strict compilation may catch malformed YAML, the defense should be at the template layer, not relying on downstream validation.

Template Location

// internal/ignition/ignition.go line 74+
const butaneTemplate = `...
{{- range .SSHKeys}}
        - "{{.}}"    // ← raw interpolation, no escaping
{{- end}}

Suggested Fix

Either:

1. Validate SSH key comments don't contain quotes/newlines in validate.SSHPublicKey()
2. Use a YAML library to generate the config instead of string templating
3. At minimum, escape double quotes in interpolated values

Severity

Medium — Requires a specifically crafted SSH key. Butane --strict may catch the broken YAML, but this is defense-in-depth. The SSH key validation should reject keys with double quotes in comments regardless.

[castrojo]

Additional detail: The template uses Go text/template (not html/template), which has zero built-in escaping. Concrete injection example:

If a user enters an SSH key comment containing YAML-significant characters:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host"\nmalicious_key: injected

The generated YAML would break the document structure. Similarly, a hostname containing a double-quote or newline could inject arbitrary YAML keys.

The fix should either:

1. Switch to a proper YAML library (e.g., gopkg.in/yaml.v3) for generating the config programmatically instead of via templates
2. Or at minimum add a YAML-escape function to the template FuncMap that quotes special characters

Option 1 is strongly preferred -- it eliminates the entire class of injection bugs.

[castrojo]

Fixed in ce917cb