[pve-devel] [PATCH v10 qemu-server 2/7] parse ovf: untaint path when calling file_size_info

[Fabian Grünbichler]

On January 13, 2022 11:08 am, Fabian Ebner wrote:
> Prepare for calling parse_ovf via API, where the -T switch is used.
> 
> Signed-off-by: Fabian Ebner <f.ebner at proxmox.com>
> ---
> 
> New in v10.
> 
>  PVE/QemuServer/OVF.pm | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/PVE/QemuServer/OVF.pm b/PVE/QemuServer/OVF.pm
> index 0376cbf..4a0d373 100644
> --- a/PVE/QemuServer/OVF.pm
> +++ b/PVE/QemuServer/OVF.pm
> @@ -221,10 +221,11 @@ ovf:Item[rasd:InstanceID='%s']/rasd:ResourceType", $controller_id);
>  	    die "error parsing $filepath, file seems not to exist at $backing_file_path\n";
>  	}
>  
> -	my $virtual_size;
> -	if ( !($virtual_size = PVE::Storage::file_size_info($backing_file_path)) ) {
> -	    die "error parsing $backing_file_path, size seems to be $virtual_size\n";
> -	}
> +	my $virtual_size = PVE::Storage::file_size_info(
> +	    ($backing_file_path =~ m|^(/.*)|)[0] # untaint
> +	);
> +	die "error parsing $backing_file_path, cannot determine file size\n"
> +	    if !$virtual_size;

nit: I think I'd prefer untainting outside of the call to 
file_size_info..

>  
>  	$pve_disk = {
>  	    disk_address => $pve_disk_address,
> -- 
> 2.30.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
>