From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 1B73D937EC for ; Thu, 5 Jan 2023 14:42:20 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id EE0A93771 for ; Thu, 5 Jan 2023 14:41:49 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Thu, 5 Jan 2023 14:41:49 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 46AA143D51 for ; Thu, 5 Jan 2023 14:41:49 +0100 (CET) Date: Thu, 5 Jan 2023 14:41:48 +0100 From: Wolfgang Bumiller To: Leo Nunner Cc: pve-devel@lists.proxmox.com Message-ID: <20230105134148.34ugmaorbb75eurj@casey.proxmox.com> References: <20230102160438.180285-1-l.nunner@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230102160438.180285-1-l.nunner@proxmox.com> X-SPAM-LEVEL: Spam detection results: 0 AWL 0.214 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: Re: [pve-devel] [PATCH v2 storage docs] Allow overrides for default directories X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jan 2023 13:42:20 -0000 Actually, I just realized that these are actually *relative* paths written "as absolute" paths, and if not, the error will now actually say that it is not an absolute path as well. Also the docs say absolute paths, but they are not. So please add a followup which drops the use of `verify_path` (rather, just allow all values or perhaps forbid it containing '..' (without even bothering checking for slashes around).