Merge pull request #554 from vyos/mergify/bp/sagitta/pr-553

T6173: validate allowed characters in ISO image name (backport #553)

scripts/build-vyos-image

@@ -28,6 +28,7 @@ import platform
 import argparse
 import datetime
 import functools
+import string
 
 import json
 
@@ -205,6 +206,13 @@ if __name__ == "__main__":
             print("Use --build-type=release option if you want to set version number")
             sys.exit(1)
 
+    # Validate characters in version name
+    if 'version' in args:
+        allowed = string.ascii_letters + string.digits + '.' + '-' + '+'
+        if not set(args['version']) <= set(allowed):
+            print(f'Version contained illegal character(s), allowed: {allowed}')
+            sys.exit(1)
+
     ## Inject some useful hardcoded options
     args['build_dir'] = defaults.BUILD_DIR
     args['pbuilder_config'] = os.path.join(defaults.BUILD_DIR, defaults.PBUILDER_CONFIG)