storage migration: insecure: improve logging

[pve-storage.git] / PVE / Storage.pm

diff --git a/PVE/Storage.pm b/PVE/Storage.pm
index 22a6ef1c3b3e494810a462dab1051aab33f10f3d..8ee2c929341c217974bb004ef3f43cdc116b5994 100755 (executable)
--- a/PVE/Storage.pm
+++ b/PVE/Storage.pm
@@ -758,8 +758,14 @@ sub storage_migrate {
                or die "receive command failed: $!\n";
            close($input);
 
-           my ($ip) = <$info> =~ /^($PVE::Tools::IPRE)$/ or die "no tunnel IP received\n";
-           my ($port) = <$info> =~ /^(\d+)$/ or die "no tunnel port received\n";
+           my $try_ip = <$info> // '';
+           my ($ip) = $try_ip =~ /^($PVE::Tools::IPRE)$/ # untaint
+               or die "no tunnel IP received, got '$try_ip'\n";
+
+           my $try_port = <$info> // '';
+           my ($port) = $try_port =~ /^(\d+)$/ # untaint
+               or die "no tunnel port received, got '$try_port'\n";
+
            my $socket = IO::Socket::IP->new(PeerHost => $ip, PeerPort => $port, Type => SOCK_STREAM)
                or die "failed to connect to tunnel at $ip:$port\n";
            # we won't be reading from the socket