proxmox-mirrors/qemu-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu-server synced 2025-08-05 08:41:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

parse ovf: untaint path when calling file_size_info

Browse Source 
Prepare for calling parse_ovf via API, where the -T switch is used.

Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
This commit is contained in:
Fabian Ebner 2022-03-09 11:09:12 +01:00 committed by Fabian Grünbichler
parent 6e55f5799e
commit 84c253e947
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
PVE/QemuServer/OVF.pm
View File

@ -221,10 +221,11 @@ ovf:Item[rasd:InstanceID='%s']/rasd:ResourceType", $controller_id);
die "error parsing $filepath, file seems not to exist at $backing_file_path\n"; die "error parsing $filepath, file seems not to exist at $backing_file_path\n";
} }
my $virtual_size; ($backing_file_path) = $backing_file_path =~ m|^(/.*)|; # untaint
if ( !($virtual_size = PVE::Storage::file_size_info($backing_file_path)) ) {
die "error parsing $backing_file_path, size seems to be $virtual_size\n"; my $virtual_size = PVE::Storage::file_size_info($backing_file_path);
} die "error parsing $backing_file_path, cannot determine file size\n"
if !$virtual_size;
$pve_disk = { $pve_disk = {
disk_address => $pve_disk_address, disk_address => $pve_disk_address,