print_text_table: untaint $width

[pve-common.git] / src / PVE / CLIFormatter.pm

diff --git a/src/PVE/CLIFormatter.pm b/src/PVE/CLIFormatter.pm
index f6ad45921842c827504ddcd7d738d6d472a54f4d..119bc063cdc0785044e745767f9274137840bd43 100644 (file)
--- a/src/PVE/CLIFormatter.pm
+++ b/src/PVE/CLIFormatter.pm
@@ -209,6 +209,8 @@ sub print_text_table {
                $width = $len if $len > $width;
            }
 
+           $width = ($width =~ m/^(\d+)$/) ? int($1) : 0; # untaint int
+
            $rowdata->{$prop} = {
                lines => $lines,
                width => $width,