From 8ecaf65405d41142a56896fbabeb49870621bdb0 Mon Sep 17 00:00:00 2001
From: Meliox <na>
Date: Sat, 13 Jun 2026 22:31:11 +0200
Subject: [PATCH] fix tainted paths and intel graphics

---
 src/node_info/files/PveMod_SensorInfo.pm        | 4 ++--
 src/node_info/files/Utils.pm                    | 8 ++++++++
 src/node_info/patches/01-nodes-pm-sensors.patch | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/node_info/files/PveMod_SensorInfo.pm b/src/node_info/files/PveMod_SensorInfo.pm
index 3027e2e..c38c4e9 100644
--- a/src/node_info/files/PveMod_SensorInfo.pm
+++ b/src/node_info/files/PveMod_SensorInfo.pm
@@ -149,8 +149,8 @@ sub _load_graphics_data {
 # API calls
 # ============================================================================
 
-sub get_graphic_info {
-    debug(__LINE__, "get_graphic_info called");
+sub get_graphics_info {
+    debug(__LINE__, "get_graphics_info called");
     if (!($config{gpu}{intel_enabled} || !$config{gpu}{nvidia_enabled} || !$config{gpu}{amd_enabled})) {
         debug(__LINE__, "GPU information collection is disabled");
         return { };
diff --git a/src/node_info/files/Utils.pm b/src/node_info/files/Utils.pm
index 8dfdfdb..2dcc765 100644
--- a/src/node_info/files/Utils.pm
+++ b/src/node_info/files/Utils.pm
@@ -215,6 +215,10 @@ sub safe_write_json {
     my ($filepath, $data, $pretty) = @_;
     $pretty //= 1;
 
+    # Untaint filepath for taint-mode environments (pveproxy runs with -T)
+    ($filepath) = ($filepath =~ /^([a-zA-Z0-9_\/\-\.]+)$/)
+        or do { debug(__LINE__, "Unsafe filepath rejected: $filepath"); return 0; };
+
     eval {
         open my $fh, '>', $filepath or die "Failed to open $filepath: $!";
         my $json = $pretty ? JSON->new->pretty->encode($data) : encode_json($data);
@@ -232,6 +236,10 @@ sub safe_write_json {
 sub safe_read_json {
     my ($filepath, $as_string) = @_;
 
+    # Untaint filepath
+    ($filepath) = ($filepath =~ /^([a-zA-Z0-9_\/\-\.]+)$/)
+        or return;
+
     return unless -f $filepath;
 
     my $result;
diff --git a/src/node_info/patches/01-nodes-pm-sensors.patch b/src/node_info/patches/01-nodes-pm-sensors.patch
index 5d8ceba..5ccd1c4 100644
--- a/src/node_info/patches/01-nodes-pm-sensors.patch
+++ b/src/node_info/patches/01-nodes-pm-sensors.patch
@@ -9,7 +9,7 @@
 +        $res->{PveMod_JsonSensorInfo} = PVE::API2::PVEMod_SensorInfo::get_sensors_info();
 +        $res->{PveMod_Version} = PVE::API2::PVEMod_SensorInfo::get_pve_mod_version();
 +        $res->{PveMod_upsInfo} = PVE::API2::PVEMod_SensorInfo::get_ups_info();
-+        $res->{PveMod_graphicInfo} = PVE::API2::PVEMod_SensorInfo::get_graphic_info();
++        $res->{PveMod_graphicsInfo} = PVE::API2::PVEMod_SensorInfo::get_graphic_info();
 +        $res->{PveMod_systemInfo} = PVE::API2::PVEMod_SensorInfo::get_system_information();
          my $dinfo = df('/', 1); # output is bytes