problem
Having the ssh key pairs being identified by their name leads to a lot of weird issues.
- The key pair validator allows commas(and other special characters like an ampersand) in the key pair name.
- The
deployVirtualMachine command keypairs parameter isn't escaped, this breaks on key pairs containing commas.
- The
deployVirtualMachine command keypair works with commas
- The UI breaks when a key pair contains commas, below is a single key containing a bunch of commas

- If the API consumer assumes the key pair name is safe and validated by cloudstack it cloud lead to a command injection(but it requires a lot of wrong assumptions)
versions
CloudStack 4.22.0.0
The steps to reproduce the bug
You can use the UI to observe most of the issues:
- Create a new key pair with a comma in the name eg.
test, test
- Try creating a new instance with said key
What to do about it?
- Add a new
keypairId array parameter to all the endpoint which access key pair name.
- Mark the
keypair and keypairs parameters deprecated.
problem
Having the ssh key pairs being identified by their name leads to a lot of weird issues.
deployVirtualMachinecommandkeypairsparameter isn't escaped, this breaks on key pairs containing commas.deployVirtualMachinecommandkeypairworks with commasversions
CloudStack 4.22.0.0
The steps to reproduce the bug
You can use the UI to observe most of the issues:
test, testWhat to do about it?
keypairIdarray parameter to all the endpoint which access key pair name.keypairandkeypairsparameters deprecated.