SectionConfig: protect against newline injection

[pve-common.git] / src / PVE / SectionConfig.pm

diff --git a/src/PVE/SectionConfig.pm b/src/PVE/SectionConfig.pm
index 71d296e6574f7a11d47a67083a45c5188c1b4887..95e166abce88d8101368ee93213b7dda33532525 100644 (file)
--- a/src/PVE/SectionConfig.pm
+++ b/src/PVE/SectionConfig.pm
@@ -393,6 +393,9 @@ my $format_config_line = sub {
 
     my $ct = $schema->{type};
 
+    die "property '$key' contains a line feed\n"
+       if ($key =~ m/[\n\r]/) || ($value =~ m/[\n\r]/);
+
     if ($ct eq 'boolean') {
        return $value ? "\t$key\n" : '';
     } else {