[PATCH qemu-server 06/10] config: hide sensitive values of unparsable lines in warnings

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

A config line that does not parse is echoed verbatim in the warning,
which ends up in task logs, the journal and the system report. For a
password line that is only broken by its formatting, for example by
leading whitespace, the warning disclosed the password, even though the
report redacts it in the config itself.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---
NOTE: needs a libpve-common-perl with the raw config redaction helpers,
as a hard runtime dependency.

 src/PVE/QemuServer.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 2a3e266b..aa1e2e9b 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -2036,7 +2036,10 @@ sub parse_vm_config {
                 $conf->{$key} = $value;
             }
         } else {
-            $handle_error->("vm $vmid - unable to parse config: $line\n");
+            my $shown = PVE::JSONSchema::redact_raw_config(
+                { properties => $confdesc }, $line, '<hidden>',
+            );
+            $handle_error->("vm $vmid - unable to parse config: $shown\n");
         }
     }
 
-- 
2.47.3