REST Handler: check for value defindness when untainting

[pve-common.git] / src / PVE / RESTHandler.pm

diff --git a/src/PVE/RESTHandler.pm b/src/PVE/RESTHandler.pm
index 04b07730fa98af4822fdd8c78c9c9084188c2756..5e8278e9a016c2f447443e535995125c0c381f35 100644 (file)
--- a/src/PVE/RESTHandler.pm
+++ b/src/PVE/RESTHandler.pm
@@ -438,7 +438,11 @@ sub handle {
        # untaint data (already validated)
        my $extra = delete $param->{'extra-args'};
        while (my ($key, $val) = each %$param) {
-           ($param->{$key}) = $val =~ /^(.*)$/s;
+           if (defined($val)) {
+               ($param->{$key}) = $val =~ /^(.*)$/s;
+           } else {
+               $param->{$key} = undef;
+           }
        }
        $param->{'extra-args'} = [map { /^(.*)$/ } @$extra] if $extra;
     }