* [pve-devel] [PATCH storage] file_size_info: check format for untrusted files
@ 2024-11-20 9:19 Dominik Csapak
0 siblings, 0 replies; only message in thread
From: Dominik Csapak @ 2024-11-20 9:19 UTC (permalink / raw)
To: pve-devel
so we fail early for files disguising as a different format (e.g. vhdx).
One can't use such files anyway since we explicitly add the expected
format to disks, so this only gives an earlier and prettier error when
e.g. importing an OVA file with such a badly named disk image.
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/Storage/Plugin.pm | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/PVE/Storage/Plugin.pm b/src/PVE/Storage/Plugin.pm
index 0b0b5a8..6a7f468 100644
--- a/src/PVE/Storage/Plugin.pm
+++ b/src/PVE/Storage/Plugin.pm
@@ -1035,6 +1035,12 @@ sub file_size_info {
$used = int($used);
($format) = ($format =~ /^(\S+)$/); # untaint
die "format '$format' includes whitespace\n" if !defined($format);
+
+ if ($untrusted) {
+ die "format '$format' not supported\n"
+ if $format ne 'raw' && $format ne 'qcow2' && $format ne 'vmdk';
+ }
+
if (defined($parent)) {
warn "strange parent name path '$parent' found\n" if $parent =~ m/[^\S]/;
($parent) = ($parent =~ /^(\S+)$/); # untaint
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-11-20 9:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-11-20 9:19 [pve-devel] [PATCH storage] file_size_info: check format for untrusted files Dominik Csapak
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox