X-Git-Url: https://git.proxmox.com/?p=pve-http-server.git;a=blobdiff_plain;f=src%2FPVE%2FAPIServer%2FAnyEvent.pm;h=8533c2f239db819d425b5fe462ab65f5d75be7af;hp=7dd7d2d062f03f2a012efbd2a4c8944e108108a4;hb=580d540ea907ba15f64379c5bb69ecf1a49a875f;hpb=34f20af2604b6bc16e84aad573962e0bfc737823

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index 7dd7d2d..8533c2f 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -293,11 +293,18 @@ sub response {
 
     my $code = $resp->code;
     my $msg = $resp->message || HTTP::Status::status_message($code);
-    ($msg) = $msg =~m/^(.*)$/m;
     my $content = $resp->content;
 
+    # multiline mode only checks \n for $, so explicitly check for any \n or \r afterwards
+    ($msg) = $msg =~ m/^(.*)$/m;
+    if ($msg =~ /[\r\n]/) {
+	$code = 400; # bad request from user
+	$msg = HTTP::Status::status_message($code);
+	$content = '';
+    }
+
     if ($code =~ /^(1\d\d|[23]04)$/) {
-	# make sure content we have no content
+	# make sure informational, no content and not modified response send no content
 	$content = "";
     }
 
@@ -695,6 +702,14 @@ sub proxy_request {
     eval {
 	my $target;
 	my $keep_alive = 1;
+
+	# stringify URI object and verify it starts with a slash
+	$uri = "$uri";
+	if ($uri !~ m@^/@) {
+	    $self->error($reqstate, 400, "invalid proxy uri");
+	    return;
+	}
+
 	if ($host eq 'localhost') {
 	    $target = "http://$host:85$uri";
 	    # keep alive for localhost is not worth (connection setup is about 0.2ms)