From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 3CEA91FF161 for ; Wed, 20 Nov 2024 10:20:08 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id CBE91A91D; Wed, 20 Nov 2024 10:20:13 +0100 (CET) From: Dominik Csapak To: pve-devel@lists.proxmox.com Date: Wed, 20 Nov 2024 10:19:41 +0100 Message-Id: <20241120091941.842833-1-d.csapak@proxmox.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.016 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH storage] file_size_info: check format for untrusted files X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" so we fail early for files disguising as a different format (e.g. vhdx). One can't use such files anyway since we explicitly add the expected format to disks, so this only gives an earlier and prettier error when e.g. importing an OVA file with such a badly named disk image. Signed-off-by: Dominik Csapak Reviewed-by: Fiona Ebner --- src/PVE/Storage/Plugin.pm | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/PVE/Storage/Plugin.pm b/src/PVE/Storage/Plugin.pm index 0b0b5a8..6a7f468 100644 --- a/src/PVE/Storage/Plugin.pm +++ b/src/PVE/Storage/Plugin.pm @@ -1035,6 +1035,12 @@ sub file_size_info { $used = int($used); ($format) = ($format =~ /^(\S+)$/); # untaint die "format '$format' includes whitespace\n" if !defined($format); + + if ($untrusted) { + die "format '$format' not supported\n" + if $format ne 'raw' && $format ne 'qcow2' && $format ne 'vmdk'; + } + if (defined($parent)) { warn "strange parent name path '$parent' found\n" if $parent =~ m/[^\S]/; ($parent) = ($parent =~ /^(\S+)$/); # untaint -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel