Merge pull request #1350 from anderbubble/sanitize-wwclient-url-data

Refactor url build in wwclient with url.URL

CHANGELOG.md

@@ -61,6 +61,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `wwctl conatiner list --kernel` shows the kernel detected for each container. #1283
 - `wwctl container list --size` shows the uncompressed size of each container. `--compressed` shows the compressed size, and `--chroot` shows the size of the container source on the server. #954, #1117
 - Add a logrotate config for `warewulfd.log`. #1311
+### Changed
+
+- Refactor URL handling in wwclient to consistently escape arguments.
+
+## v4.5.6, unreleased
 
 ### Fixed
 

internal/app/wwclient/root.go

@@ -133,7 +133,7 @@ func CobraRunE(cmd *cobra.Command, args []string) (err error) {
 		if tag == "Unknown" {
 			dmiOut, err := exec.Command("dmidecode", "-s", "chassis-asset-tag").Output()
 			if err == nil {
-				chassisAssetTag := url.QueryEscape(strings.TrimSpace(string(dmiOut)))
+				chassisAssetTag := strings.TrimSpace(string(dmiOut))
 				if chassisAssetTag != "" {
 					tag = chassisAssetTag
 				}
@@ -221,9 +221,19 @@ func updateSystem(ipaddr string, port int, wwid string, tag string, localUUID uu
 	counter := 0
 	for {
 		var err error
-		getString := fmt.Sprintf("http://%s:%d/provision/%s?assetkey=%s&uuid=%s&stage=runtime&compress=gz", ipaddr, port, wwid, tag, localUUID)
-		wwlog.Debug("Making request: %s", getString)
-		resp, err = Webclient.Get(getString)
+		values := &url.Values{}
+		values.Set("assetkey", tag)
+		values.Set("uuid", localUUID.String())
+		values.Set("stage", "runtime")
+		values.Set("compress", "gz")
+		getURL := &url.URL{
+			Scheme:   "http",
+			Host:     fmt.Sprintf("%s:%d", ipaddr, port),
+			Path:     fmt.Sprintf("provision/%s", wwid),
+			RawQuery: values.Encode(),
+		}
+		wwlog.Debug("Making request: %s", getURL)
+		resp, err = Webclient.Get(getURL.String())
 		if err == nil {
 			break
 		} else {