From 07d98bebe848231a8783bef5b50f079b04de66bf Mon Sep 17 00:00:00 2001
From: Aditya Kali <adityakali@google.com>
Date: Wed, 24 Aug 2016 12:43:31 -0700
Subject: [PATCH] Validate KUBE_USER and KUBE_PASSWORD early on

Make sure KUBE_USER and KUBE_PASSWORD contains valid chars
as soon as we read them from kube config.
---
 cluster/common.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/cluster/common.sh b/cluster/common.sh
index e87506e0f5..47c26956b6 100755
--- a/cluster/common.sh
+++ b/cluster/common.sh
@@ -257,6 +257,16 @@ function load-or-gen-kube-basicauth() {
   if [[ -z "${KUBE_USER:-}" || -z "${KUBE_PASSWORD:-}" ]]; then
     gen-kube-basicauth
   fi
+
+  # Make sure they don't contain any funny characters.
+  if ! [[ "${KUBE_USER}" =~ ^[-._@a-zA-Z0-9]+$ ]]; then
+    echo "Bad KUBE_USER string."
+    exit 1
+  fi
+  if ! [[ "${KUBE_PASSWORD}" =~ ^[-._@#%/a-zA-Z0-9]+$ ]]; then
+    echo "Bad KUBE_PASSWORD string."
+    exit 1
+  fi
 }
 
 function load-or-gen-kube-bearertoken() {