OpenSource/PVE-mods
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix tainted paths and intel graphics

Browse Source
This commit is contained in:
Meliox 2026-06-13 22:31:11 +02:00
parent 68b7d6f3ec
commit 8ecaf65405
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/node_info/files/PveMod_SensorInfo.pm
View File

@ -149,8 +149,8 @@ sub _load_graphics_data {
# API calls # API calls
# ============================================================================ # ============================================================================
sub get_graphic_info { sub get_graphics_info {
debug(__LINE__, "get_graphic_info called"); debug(__LINE__, "get_graphics_info called");
if (!($config{gpu}{intel_enabled} || !$config{gpu}{nvidia_enabled} || !$config{gpu}{amd_enabled})) { if (!($config{gpu}{intel_enabled} || !$config{gpu}{nvidia_enabled} || !$config{gpu}{amd_enabled})) {
debug(__LINE__, "GPU information collection is disabled"); debug(__LINE__, "GPU information collection is disabled");
return { }; return { };

8
src/node_info/files/Utils.pm
View File

@ -215,6 +215,10 @@ sub safe_write_json {
my ($filepath, $data, $pretty) = @_; my ($filepath, $data, $pretty) = @_;
$pretty //= 1; $pretty //= 1;
# Untaint filepath for taint-mode environments (pveproxy runs with -T)
($filepath) = ($filepath =~ /^([a-zA-Z0-9_\/\-\.]+)$/)
or do { debug(__LINE__, "Unsafe filepath rejected: $filepath"); return 0; };
eval { eval {
open my $fh, '>', $filepath or die "Failed to open $filepath: $!"; open my $fh, '>', $filepath or die "Failed to open $filepath: $!";
my $json = $pretty ? JSON->new->pretty->encode($data) : encode_json($data); my $json = $pretty ? JSON->new->pretty->encode($data) : encode_json($data);
@ -232,6 +236,10 @@ sub safe_write_json {
sub safe_read_json { sub safe_read_json {
my ($filepath, $as_string) = @_; my ($filepath, $as_string) = @_;
# Untaint filepath
($filepath) = ($filepath =~ /^([a-zA-Z0-9_\/\-\.]+)$/)
or return;
return unless -f $filepath; return unless -f $filepath;
my $result; my $result;

2
src/node_info/patches/01-nodes-pm-sensors.patch
View File

@ -9,7 +9,7 @@
+ $res->{PveMod_JsonSensorInfo} = PVE::API2::PVEMod_SensorInfo::get_sensors_info(); + $res->{PveMod_JsonSensorInfo} = PVE::API2::PVEMod_SensorInfo::get_sensors_info();
+ $res->{PveMod_Version} = PVE::API2::PVEMod_SensorInfo::get_pve_mod_version(); + $res->{PveMod_Version} = PVE::API2::PVEMod_SensorInfo::get_pve_mod_version();
+ $res->{PveMod_upsInfo} = PVE::API2::PVEMod_SensorInfo::get_ups_info(); + $res->{PveMod_upsInfo} = PVE::API2::PVEMod_SensorInfo::get_ups_info();
+ $res->{PveMod_graphicInfo} = PVE::API2::PVEMod_SensorInfo::get_graphic_info(); + $res->{PveMod_graphicsInfo} = PVE::API2::PVEMod_SensorInfo::get_graphic_info();
+ $res->{PveMod_systemInfo} = PVE::API2::PVEMod_SensorInfo::get_system_information(); + $res->{PveMod_systemInfo} = PVE::API2::PVEMod_SensorInfo::get_system_information();
my $dinfo = df('/', 1); # output is bytes my $dinfo = df('/', 1); # output is bytes