From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 9A25B1FF16F for ; Fri, 15 Nov 2024 16:20:03 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9FC7E184F5; Fri, 15 Nov 2024 16:18:31 +0100 (CET) From: Dominik Csapak To: pve-devel@lists.proxmox.com Date: Fri, 15 Nov 2024 16:17:40 +0100 Message-Id: <20241115151749.633407-19-d.csapak@proxmox.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241115151749.633407-1-d.csapak@proxmox.com> References: <20241115151749.633407-1-d.csapak@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.016 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH qemu-server v6 6/6] api: check untrusted image files for import content type X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" check to be imported files for external references if they are of content type 'import'. Signed-off-by: Dominik Csapak --- new in v6 PVE/API2/Qemu.pm | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm index 58aaabbe..cbbd1e36 100644 --- a/PVE/API2/Qemu.pm +++ b/PVE/API2/Qemu.pm @@ -440,6 +440,7 @@ my sub create_disks : prototype($$$$$$$$$$$) { my ($vtype, undef, undef, undef, undef, undef, $fmt) = PVE::Storage::parse_volname($storecfg, $source); my $needs_extraction = PVE::QemuServer::Helpers::needs_extraction($vtype, $fmt); + my $untrusted = $vtype eq 'import' ? 1 : 0; if ($needs_extraction) { print "extracting $source\n"; my $extracted_volid = PVE::GuestImport::extract_disk_from_import_file( @@ -458,7 +459,8 @@ my sub create_disks : prototype($$$$$$$$$$$) { my $path = PVE::Storage::path($storecfg, $source) or die "failed to get a path for '$source'\n"; $source = $path; - ($size, my $source_format) = PVE::Storage::file_size_info($source); + # check potentially untrusted image file for import vtype + ($size, my $source_format) = PVE::Storage::file_size_info($source, undef, $untrusted); die "could not get file size of $source\n" if !$size; $live_import_mapping->{$ds} = { @@ -468,6 +470,13 @@ my sub create_disks : prototype($$$$$$$$$$$) { $live_import_mapping->{$ds}->{'delete-after-finish'} = $source if $needs_extraction; } else { + # check potentially untrusted image file for import vtype + if ($untrusted) { + my $scfg = PVE::Storage::storage_config($storecfg, $source_storage); + my $path = PVE::Storage::path($storecfg, $source); + PVE::Storage::file_size_info($path, undef, 1); + } + my $dest_info = { vmid => $vmid, drivename => $ds, -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel