plugins: untaint volume_size_info retuns

[pve-storage.git] / PVE / Storage / Plugin.pm

diff --git a/PVE/Storage/Plugin.pm b/PVE/Storage/Plugin.pm
index d330845fd1622fbe0347b540be1666f24f7074fd..b1165f75bcf592ee602a1b5613172799e7ab3c90 100644 (file)
--- a/PVE/Storage/Plugin.pm
+++ b/PVE/Storage/Plugin.pm
@@ -134,7 +134,7 @@ my $defaultData = {
        },
        maxfiles => {
            description => "Deprecated: use 'prune-backups' instead. " .
-               "Maximal number of backup files per VM. Use '0' for unlimted.",
+               "Maximal number of backup files per VM. Use '0' for unlimited.",
            type => 'integer',
            minimum => 0,
            optional => 1,
@@ -445,7 +445,7 @@ sub parse_config {
 # Storage implementation
 
 # called during addition of storage (before the new storage config got written)
-# die to abort additon if there are (grave) problems
+# die to abort addition if there are (grave) problems
 # NOTE: runs in a storage config *locked* context
 sub on_add_hook {
     my ($class, $storeid, $scfg, %param) = @_;
@@ -553,7 +553,7 @@ sub get_subdir {
 
     my $path = $scfg->{path};
 
-    die "storage definintion has no path\n" if !$path;
+    die "storage definition has no path\n" if !$path;
 
     my $subdir = $vtype_subdirs->{$vtype};
 
@@ -689,7 +689,7 @@ sub clone_image {
     my ($class, $scfg, $storeid, $volname, $vmid, $snap) = @_;
 
     # this only works for file based storage types
-    die "storage definintion has no path\n" if !$scfg->{path};
+    die "storage definition has no path\n" if !$scfg->{path};
 
     my ($vtype, $basename, $basevmid, undef, undef, $isBase, $format) =
        $class->parse_volname($volname);
@@ -837,6 +837,12 @@ sub file_size_info {
 
     my ($size, $format, $used, $parent) = $info->@{qw(virtual-size format actual-size backing-filename)};
 
+    ($size) = ($size =~ /^(\d+)$/); #untaint
+    ($used) = ($used =~ /^(\d+)$/); #untaint
+    ($format) = ($format =~ /^([-\w]+)$/); #untaint
+    if (defined($parent)) {
+       ($parent) = ($parent =~ /^(.*)$/); #untaint
+    }
     return wantarray ? ($size, $format, $used, $parent, $st->ctime) : $size;
 }
 
@@ -1142,7 +1148,7 @@ sub status {
 
     my $path = $scfg->{path};
 
-    die "storage definintion has no path\n" if !$path;
+    die "storage definition has no path\n" if !$path;
 
     my $timeout = 2;
     my $res = PVE::Tools::df($path, $timeout);
@@ -1166,7 +1172,7 @@ sub activate_storage {
 
     my $path = $scfg->{path};
 
-    die "storage definintion has no path\n" if !$path;
+    die "storage definition has no path\n" if !$path;
 
     # this path test may hang indefinitely on unresponsive mounts
     my $timeout = 2;