2 Commits
Author SHA1 Message Date
nicolargo f3f50323d8 SQL Injection leading to Data Exfiltration via OOB (Out-of-Band) in Glances ClickHouse Export Module - GHSA-2hvx-g9v6-w29h 2026-09-12 15:30:08 +02:00
Aditya Raj Singh 946c34f687 fix(plugins): init containers, vms and smart stats as a list
These three plugins expose a list of stats but inherited the base class's
stats_init_value default of {}. get_init_value() is what update() returns when
it has nothing to report, and what reset() installs, so /api/4/containers
answered {} instead of [] whenever no container engine library was importable -
the empty-dict-for-empty-list the issue reports.

containers and vms simply never passed stats_init_value. smart declared
stats_init_value=[] as its own parameter default and then dropped it on the way
to super().__init__(), so it read as correct while behaving the same way; a grep
for the keyword finds it, only running it does not.

Every other list plugin already passes stats_init_value=[]. tests/test_restful.py
carries a workaround for this exact symptom, added in 4c92e1b as "allow empty
dicts for list plugins" - it was read as test flakiness rather than a bug.

Fixes #3582
2026-08-22 01:27:51 +05:30