From 92efe5c6cb9904ebf7bbb7f8d690ac80e7c91e23 Mon Sep 17 00:00:00 2001 From: Friedrich Weber Date: Thu, 31 Jul 2025 09:13:02 +0200 Subject: [PATCH] plugin: lvm: volume snapshot info: untaint snapshot filename Without untainting, offline-deleting a volume-chain snapshot on an LVM storage via the GUI can fail with an "Insecure dependecy in exec [...]" error, because volume_snapshot_delete uses the filename its qemu-img invocation. Commit 93f0dfb ("plugin: volume snapshot info: untaint snapshot filename") fixed this already for the volume_snapshot_info implementation of the Plugin base class, but missed that the LVM plugin overrides the method and was still missing the untaint. Signed-off-by: Friedrich Weber Link: https://lore.proxmox.com/20250731071306.11777-1-f.weber@proxmox.com --- src/PVE/Storage/LVMPlugin.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/src/PVE/Storage/LVMPlugin.pm b/src/PVE/Storage/LVMPlugin.pm index e3fe9ff..0416c9e 100644 --- a/src/PVE/Storage/LVMPlugin.pm +++ b/src/PVE/Storage/LVMPlugin.pm @@ -831,6 +831,7 @@ sub volume_snapshot_info { my $snapshots = $json_decode; for my $snap (@$snapshots) { my $snapfile = $snap->{filename}; + ($snapfile) = $snapfile =~ m|^(/.*)|; # untaint my $snapname = $get_snapname_from_path->($snapfile); #not a proxmox snapshot next if !$snapname;