From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id B8C171FF0E5 for ; Wed, 15 Jul 2026 12:11:05 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 1C5322140A; Wed, 15 Jul 2026 12:11:05 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v2 1/1] fix #7818: disallow vertical spaces in firewall comments Date: Wed, 15 Jul 2026 12:10:53 +0200 Message-ID: <20260715101054.31295-1-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784110243118 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.058 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: HDNAAJPONS2DFDR5PY5PLSXN26YXHDHU X-Message-ID-Hash: HDNAAJPONS2DFDR5PY5PLSXN26YXHDHU X-MailFrom: s.hanreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: They do not get sanitized and interpreted literally, allowing for authenticated users to inject additional lines into the firewall configuration files. Additionally restrict the comments to only printable characters which additionally prevents control characters in comments. Suggested-by: Stoiko Ivanov Signed-off-by: Stefan Hanreich --- Notes: Changes from v1 (Thanks @Stoiko): * disallow any vertical space instead of line feeds only * additionally only allow printable characters Did quickly check the other properties as well, but couldn't find anything. Will take a closer look still but wanted to get the patch ready in the meanwhile. src/PVE/Firewall.pm | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 93f8c34..8ec2b80 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -1228,6 +1228,22 @@ sub pve_fw_verify_icmp_type_spec { return $icmp_type; } +PVE::JSONSchema::register_format('pve-fw-comment-spec', \&pve_fw_verify_comment_spec); + +sub pve_fw_verify_comment_spec { + my ($comment) = @_; + + if ($comment =~ m/\p{VertSpace}/) { + die "comment must not contain any line feeds\n"; + } + + if ($comment !~ m/^\p{Print}*$/) { + die "comment must only contain printable characters\n"; + } + + return $comment; +} + # helper function for API sub copy_opject_with_digest { @@ -1623,6 +1639,7 @@ my $rule_properties = { description => "Descriptive comment.", type => 'string', optional => 1, + format => 'pve-fw-comment-spec', }, 'icmp-type' => { description => -- 2.47.3