Fix command injection vulnerability in disk.usage

salt/modules/disk.py

@@ -31,14 +31,21 @@ def usage(args=None):
 
         salt '*' disk.usage
     '''
+    flags = ''
+    allowed = ('a', 'B', 'h', 'H', 'i', 'k', 'l', 'P', 't', 'T', 'x', 'v')
+    for flag in args:
+        if flag in allowed:
+            flags += flag
+        else:
+            break
     if __grains__['kernel'] == 'Linux':
         cmd = 'df -P'
     elif __grains__['kernel'] == 'OpenBSD':
         cmd = 'df -kP'
     else:
         cmd = 'df'
     if args:
-        cmd = cmd + ' -' + args
+        cmd += ' -{0}'.format(flags)
     ret = {}
     out = __salt__['cmd.run'](cmd).splitlines()
     for line in out: