From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 5FAD31FF183 for ; Wed, 19 Nov 2025 12:11:50 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 5CE814051; Wed, 19 Nov 2025 12:11:55 +0100 (CET) From: Lukas Wagner To: pdm-devel@lists.proxmox.com Date: Wed, 19 Nov 2025 12:11:05 +0100 Message-ID: <20251119111105.174145-1-l.wagner@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1763550651297 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.031 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pdm-devel] [PATCH proxmox] rrd: restrict archive path via regex X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" The `rel_path` parameter is used as a relative path inside the `rrdb` base directory to build the final path for the archive file. Usually, this is something like 'node/localhost/cpu_avg1'. For PBS, this is fine, since these paths are hardcoded or derived from safe datastore names. In PDM however, these paths are built from potentially 'untrusted' (as in, one could 'pretend' to be a PBS/PVE remote and send malicious data) metric data points - so we should have additional safe guards in place to disallow potentially dangerous paths like '../abc' which would escape the base directory. Signed-off-by: Lukas Wagner --- proxmox-rrd/Cargo.toml | 4 +++- proxmox-rrd/src/cache.rs | 11 +++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/proxmox-rrd/Cargo.toml b/proxmox-rrd/Cargo.toml index 5ff6ec98..240d00cc 100644 --- a/proxmox-rrd/Cargo.toml +++ b/proxmox-rrd/Cargo.toml @@ -16,15 +16,17 @@ proxmox-router = { workspace = true, features = ["cli", "server"] } [dependencies] anyhow.workspace = true bitflags.workspace = true +const_format.workspace = true crossbeam-channel.workspace = true log.workspace = true nix.workspace = true +regex.workspace = true serde = { workspace = true, features = ["derive"] } serde_cbor.workspace = true serde_json.workspace = true serde_plain.workspace = true -proxmox-schema = { workspace = true, features = [ "api-macro" ] } +proxmox-schema = { workspace = true, features = [ "api-macro", "api-types" ] } proxmox-sys.workspace = true proxmox-time.workspace = true diff --git a/proxmox-rrd/src/cache.rs b/proxmox-rrd/src/cache.rs index 29d46ed5..042b4213 100644 --- a/proxmox-rrd/src/cache.rs +++ b/proxmox-rrd/src/cache.rs @@ -8,8 +8,11 @@ use std::thread::spawn; use std::time::SystemTime; use anyhow::{bail, format_err, Error}; +use const_format::concatcp; use crossbeam_channel::{bounded, TryRecvError}; +use proxmox_schema::api_types::SAFE_ID_REGEX_STR; +use proxmox_schema::const_regex; use proxmox_sys::fs::{create_path, CreateOptions}; use crate::rrd::{AggregationFn, DataSourceType, Database}; @@ -21,6 +24,10 @@ use journal::*; mod rrd_map; use rrd_map::*; +const_regex! { + DATAPOINT_PATH_REGEX = concatcp!(r"^", SAFE_ID_REGEX_STR, r"(/", SAFE_ID_REGEX_STR, r")+$"); +} + /// RRD cache - keep RRD data in RAM, but write updates to disk /// /// This cache is designed to run as single instance (no concurrent @@ -214,6 +221,10 @@ impl Cache { dst: DataSourceType, new_only: bool, ) -> Result<(), Error> { + if !DATAPOINT_PATH_REGEX.is_match(rel_path) { + bail!("invalid datapoint path: {rel_path}"); + } + let journal_applied = self.apply_journal()?; self.state -- 2.47.3 _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel