From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 455DC1FF184 for ; Thu, 20 Nov 2025 12:00:42 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 8A6023C41; Thu, 20 Nov 2025 12:00:48 +0100 (CET) From: Lukas Wagner To: pdm-devel@lists.proxmox.com Date: Thu, 20 Nov 2025 12:00:33 +0100 Message-ID: <20251120110033.160931-1-l.wagner@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1763636410055 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.031 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [cache.rs] Subject: [pdm-devel] [PATCH proxmox v2] rrd: update_value: restrict archive file path X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" The `rel_path` parameter is used as a relative path inside the `rrdb` base directory to build the final path for the archive file. Usually, this is something like 'node/localhost/cpu_avg1'. For PBS, this is fine, since these paths are hardcoded or derived from safe datastore names. In PDM however, these paths are built from potentially 'untrusted' (as in, one could 'pretend' to be a PBS/PVE remote and send malicious data) metric data points - so we should have additional safe guards in place to disallow potentially dangerous paths like '../abc' which would escape the base directory. This commit adds a check which ensures that the path does not contain '../' which could be used to access a parent directory. In the future, it would be best to ensure that the actual file operations are contained. This could be achieved by using openat2 with a dirfd from the basedir directory and the open_how RESOLVE_BENEATH mode being used, so that it's anchored to the correct directory. This is a bigger change, which is why it is not done at this very moment. Signed-off-by: Lukas Wagner --- proxmox-rrd/src/cache.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/proxmox-rrd/src/cache.rs b/proxmox-rrd/src/cache.rs index 29d46ed5..fe5c18ec 100644 --- a/proxmox-rrd/src/cache.rs +++ b/proxmox-rrd/src/cache.rs @@ -214,6 +214,10 @@ impl Cache { dst: DataSourceType, new_only: bool, ) -> Result<(), Error> { + if rel_path.contains("../") { + bail!("invalid path when trying to update value: {rel_path}"); + } + let journal_applied = self.apply_journal()?; self.state -- 2.47.3 _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel