pbs add/update: do basic key value validation

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/PVE/Storage/PBSPlugin.pm b/PVE/Storage/PBSPlugin.pm
index e046e99f4831dfc0d63d1f30bfd501db5f007071..3e66bfcde9c441fc751c09fcbec465bf913eedb4 100644 (file)
--- a/PVE/Storage/PBSPlugin.pm
+++ b/PVE/Storage/PBSPlugin.pm
@@ -391,9 +391,14 @@ sub on_add_hook {
     }
 
     if (defined(my $encryption_key = $param{'encryption-key'})) {
+       my $decoded_key;
        if ($encryption_key eq 'autogen') {
            $res->{'encryption-key'} = $autogen_encryption_key->($scfg, $storeid);
        } else {
+           $decoded_key = eval { decode_json($encryption_key) };
+           if ($@ || !exists($decoded_key->{data})) {
+               die "Value does not seems like a valid, JSON formatted encryption key!\n";
+           }
            pbs_set_encryption_key($scfg, $storeid, $encryption_key);
            $res->{'encryption-key'} = $encryption_key;
        }
@@ -420,9 +425,14 @@ sub on_update_hook {
 
     if (exists($param{'encryption-key'})) {
        if (defined(my $encryption_key = delete($param{'encryption-key'}))) {
+           my $decoded_key;
            if ($encryption_key eq 'autogen') {
                $res->{'encryption-key'} = $autogen_encryption_key->($scfg, $storeid);
            } else {
+               $decoded_key = eval { decode_json($encryption_key) };
+               if ($@ || !exists($decoded_key->{data})) {
+                   die "Value does not seems like a valid, JSON formatted encryption key!\n";
+               }
                pbs_set_encryption_key($scfg, $storeid, $encryption_key);
                $res->{'encryption-key'} = $encryption_key;
            }