Proxmox/pve-storage
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-storage.git synced 2025-02-25 17:57:31 +03:00
Code Releases Activity

plugin: file_size_info: warn on parent images with unusual path

Browse Source 
If the base image (parent) of an image contains e.g. whitespace in it's
path, the current untainting would not match and it would seem there was
no parent.

Since untrusted files are not allowed to have backing parts, just warn,
when encountering this case to keep backwards compatibility.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2024-11-18 16:29:14 +01:00 committed by Thomas Lamprecht
parent 357deeb864
commit e36c01aff7
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/PVE/Storage/Plugin.pm
View File

@ -1031,6 +1031,7 @@ sub file_size_info {
($format) = ($format =~ /^(\S+)$/); # untaint
die "format '$format' includes whitespace\n" if !defined($format);
if (defined($parent)) {
warn "strange parent name path '$parent' found\n" if $parent =~ m/[^\S]/;
($parent) = ($parent =~ /^(\S+)$/); # untaint
}
return wantarray ? ($size, $format, $used, $parent, $st->ctime) : $size;