Dev: ui_resource: Refactor do_trace function

[liangxin1300]

Ensure the trace directory is specified either through the argument or by using the value of the heartbeat_dir option. Eliminate any inconsistencies that might arise from heartbeat_dir (from etc/crm/crm.conf) or from HA_VARLIB (from /usr/lib/ocf/heartbeat/ocf-directories).

[codecov]

Codecov Report

Attention: Patch coverage is 80.00000% with 6 lines in your changes missing coverage. Please review.

Project coverage is 69.96%. Comparing base (ee7aaf4) to head (ee920d1).
Report is 3 commits behind head on master.

Files with missing lines	Patch %	Lines
crmsh/ui_resource.py	79.16%	5 Missing ⚠️
crmsh/utils.py	83.33%	1 Missing ⚠️

Additional details and impacted files

Flag	Coverage Δ
integration	54.17% <80.00%> (+0.02%)	⬆️
unit	52.57% <3.33%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crmsh/config.py	81.48% <ø> (ø)
crmsh/utils.py	66.39% <83.33%> (+0.05%)	⬆️
crmsh/ui_resource.py	72.83% <79.16%> (+0.14%)	⬆️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nicholasyang2022]

DANGEROUS:

1. Sourcing a script is vulnerable to shell injection.
2. script_path and var_name is not quoted.

Although it is safe when sourcing trusted code, this should not be defined as a common utility function.

[liangxin1300]

How about:

Suggested change

	cmd = f"source {script_path} && echo ${var_name}"
	cmd = ['/bin/bash', '-c', f'source {script_path} && echo ${var_name}']
	rc, out, _ = ShellUtils().get_stdout_stderr(cmd, shell=False)

[zzhou1]

I agree Nicholas for the security risk, and not to source the script. Instead, it is safe for the use case to directly use python re to parse {HA_VARLIB:=/var/lib/heartbeat}.

If "rpm -ql resource-agents" is not available, then crmsh falls back to the hard code of /usr/lib/ocf/lib/heartbeat/ocf-directories.