parse ovf: untaint path when calling file_size_info

Prepare for calling parse_ovf via API, where the -T switch is used.

Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>

diff --git a/PVE/QemuServer/OVF.pm b/PVE/QemuServer/OVF.pm
index 0376cbf523f61244bf73742aa76785906a1ddb32..b97b052001be1be4dbbf7abc19c8cbb102a980f6 100644 (file)
--- a/PVE/QemuServer/OVF.pm
+++ b/PVE/QemuServer/OVF.pm
@@ -221,10 +221,11 @@ ovf:Item[rasd:InstanceID='%s']/rasd:ResourceType", $controller_id);
            die "error parsing $filepath, file seems not to exist at $backing_file_path\n";
        }
 
-       my $virtual_size;
-       if ( !($virtual_size = PVE::Storage::file_size_info($backing_file_path)) ) {
-           die "error parsing $backing_file_path, size seems to be $virtual_size\n";
-       }
+       ($backing_file_path) = $backing_file_path =~ m|^(/.*)|; # untaint
+
+       my $virtual_size = PVE::Storage::file_size_info($backing_file_path);
+       die "error parsing $backing_file_path, cannot determine file size\n"
+           if !$virtual_size;
 
        $pve_disk = {
            disk_address => $pve_disk_address,