From 274c5f7482d2a8dbbcd7fbcfdab2a340a9e47805 Mon Sep 17 00:00:00 2001 From: Davi Torres <90287660+daviftorres@users.noreply.github.com> Date: Mon, 30 Mar 2026 21:16:32 -0400 Subject: [PATCH] Domain is passed as a REGEX pattern, not a literal string. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This change ensures consistency with how paths are parsed when updating a domain path. The modified line was passing the domain name as a literal string, but it is actually interpreted as a regular expression internally. I couldn’t find a way to exploit this issue, but it could still cause data corruption if a domain name accidentally contains regex metacharacters. Note that this same technique is already used in a similar situation on line 1118. A common example is when an organization uses its DNS name as the "domain" (tenant), like `company.com`. In this case, the `.` (dot) is treated as a regex wildcard, meaning it can match any character... --- server/src/main/java/com/cloud/user/DomainManagerImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/user/DomainManagerImpl.java b/server/src/main/java/com/cloud/user/DomainManagerImpl.java index 28f9bd3ab39..ac6cdcc821b 100644 --- a/server/src/main/java/com/cloud/user/DomainManagerImpl.java +++ b/server/src/main/java/com/cloud/user/DomainManagerImpl.java @@ -938,7 +938,7 @@ public class DomainManagerImpl extends ManagerBase implements DomainManager, Dom List domainChildren = _domainDao.findAllChildren(domain.getPath(), domain.getId()); // for each child, update the path for (DomainVO dom : domainChildren) { - dom.setPath(dom.getPath().replaceFirst(domain.getPath(), updatedDomainPrefix)); + dom.setPath(StringUtils.replaceOnce(dom.getPath(), domain.getPath(), updatedDomainPrefix)); _domainDao.update(dom.getId(), dom); } }