PVE::ACME - untaint saved account data

Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e827aa9542ad611b7fada9a64e90d88edb1b0d26..38a14a500e83c8918ff545ba333d7fb2ac4bcf47 100644 (file)
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -152,7 +152,9 @@ sub load {
     my ($self) = @_;
     return if $self->{loaded};
     $self->{loaded} = 1;
-    my $data = fromjs(file_get_contents($self->{path}));
+    my $raw = file_get_contents($self->{path});
+    if ($raw =~ m/^(.*)$/s) { $raw = $1; }  # untaint
+    my $data = fromjs($raw);
     $self->{$_} = $data->{$_} for @SAVED_VALUES;
     if (defined(my $keystr = $data->{key})) {
        my $key = Crypt::OpenSSL::RSA->new_private_key($keystr);