tronnet/ProxmoxAAS-API
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mitigate some vulnerabilities in disk attach,

Browse Source 
handle errors in getDiskInfo as result of nonexistent disk
This commit is contained in:
Arthur Lu 2023-05-18 08:09:18 +00:00
parent 2cd23324e5
commit 70953f3194
2 changed files with 40 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
main.js
View File

@ -25,7 +25,7 @@ app.get("/api/echo", (req, res) => {
}); });
app.get("/api/auth", async (req, res) => { app.get("/api/auth", async (req, res) => {
let auth = await checkAuth(req.cookies); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; } if (!auth) { return; }
res.status(200).send({ auth: true }); res.status(200).send({ auth: true });
}); });
@ -115,10 +115,20 @@ app.post("/api/instance/disk/attach", async (req, res) => {
let vmpath = `/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}`; let vmpath = `/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}`;
let auth = await checkAuth(req.cookies, res, vmpath); let auth = await checkAuth(req.cookies, res, vmpath);
if (!auth) { return; } if (!auth) { return; }
// get current config and check if unused disk exists
let config = await requestPVE(`${vmpath}/config`, "GET", req.cookies, null, null);
if (!config.data.data[`unused${req.body.source}`]) {
res.status(403).send({ error: `requested disk unused${req.body.source} does not exist` });
res.end();
return;
}
let sourceDisk = config.data.data[`unused${req.body.source}`];
// setup action using source disk info from vm config
let action = {}; let action = {};
action[req.body.disk] = req.body.data; action[req.body.disk] = sourceDisk;
action = JSON.stringify(action); action = JSON.stringify(action);
let method = req.body.type === "qemu" ? "POST" : "PUT"; let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken); let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);
}); });
@ -179,7 +189,7 @@ app.post("/api/instance/disk/move", async (req, res) => {
res.end(); res.end();
return; return;
} }
// create action
let action = { storage: req.body.storage, delete: req.body.delete }; let action = { storage: req.body.storage, delete: req.body.delete };
if (req.body.type === "qemu") { if (req.body.type === "qemu") {
action.disk = req.body.disk action.disk = req.body.disk
@ -189,6 +199,7 @@ app.post("/api/instance/disk/move", async (req, res) => {
} }
action = JSON.stringify(action); action = JSON.stringify(action);
let route = req.body.type === "qemu" ? "move_disk" : "move_volume"; let route = req.body.type === "qemu" ? "move_disk" : "move_volume";
// commit action
let result = await requestPVE(`${vmpath}/${route}`, "POST", req.cookies, action, pveAPIToken); let result = await requestPVE(`${vmpath}/${route}`, "POST", req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);
}); });
@ -204,6 +215,7 @@ app.post("/api/instance/disk/delete", async (req, res) => {
res.end(); res.end();
return; return;
} }
// create action
let action = JSON.stringify({ delete: req.body.disk }); let action = JSON.stringify({ delete: req.body.disk });
let method = req.body.type === "qemu" ? "POST" : "PUT"; let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action // commit action
@ -227,6 +239,7 @@ app.post("/api/instance/disk/create", async (req, res) => {
return; return;
} }
} }
// setup action
let action = {}; let action = {};
if (req.body.disk.includes("ide") && req.body.iso) { if (req.body.disk.includes("ide") && req.body.iso) {
action[req.body.disk] = `${req.body.iso},media=cdrom`; action[req.body.disk] = `${req.body.iso},media=cdrom`;
@ -262,11 +275,12 @@ app.post("/api/instance/network", async (req, res) => {
res.end(); res.end();
return; return;
} }
// commit action // setup action
let action = {}; let action = {};
action[`net${req.body.netid}`] = currentNetworkConfig.replace(`rate=${currentNetworkRate}`, `rate=${req.body.rate}`); action[`net${req.body.netid}`] = currentNetworkConfig.replace(`rate=${currentNetworkRate}`, `rate=${req.body.rate}`);
action = JSON.stringify(action); action = JSON.stringify(action);
let method = req.body.type === "qemu" ? "POST" : "PUT"; let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken); let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);
}); });
@ -288,9 +302,10 @@ app.post("/api/instance/resources", async (req, res) => {
res.end(); res.end();
return; return;
} }
// commit action // setup action
let action = JSON.stringify({ cores: req.body.cores, memory: req.body.memory }); let action = JSON.stringify({ cores: req.body.cores, memory: req.body.memory });
let method = req.body.type === "qemu" ? "POST" : "PUT"; let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken); let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);
}); });
@ -349,8 +364,8 @@ app.post("/api/instance", async (req, res) => {
res.end(); res.end();
return; return;
} }
// commit action
action = JSON.stringify(action); action = JSON.stringify(action);
// commit action
let result = await requestPVE(`/nodes/${req.body.node}/${req.body.type}`, "POST", req.cookies, action, pveAPIToken); let result = await requestPVE(`/nodes/${req.body.node}/${req.body.type}`, "POST", req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);
}); });

29
pve.js
View File

@ -56,13 +56,18 @@ export async function handleResponse(node, result, res) {
let upid = result.data.data; let upid = result.data.data;
while (true) { while (true) {
let taskStatus = await requestPVE(`/nodes/${node}/tasks/${upid}/status`, "GET", null, null, pveAPIToken); let taskStatus = await requestPVE(`/nodes/${node}/tasks/${upid}/status`, "GET", null, null, pveAPIToken);
let taskLog = await requestPVE(`/nodes/${node}/tasks/${upid}/log`, "GET", null, null, pveAPIToken);
if (taskStatus.data.data.status === "stopped" && taskStatus.data.data.exitstatus === "OK") { if (taskStatus.data.data.status === "stopped" && taskStatus.data.data.exitstatus === "OK") {
res.status(200).send(taskStatus.data.data); let result = taskStatus.data.data;
result.log = taskLog.data.data;
res.status(200).send(result);
res.end(); res.end();
return; return;
} }
else if (taskStatus.data.data.status === "stopped") { else if (taskStatus.data.data.status === "stopped") {
res.status(500).send(taskStatus.data.data); let result = taskStatus.data.data;
result.log = taskLog.data.data;
res.status(500).send(result);
res.end(); res.end();
return; return;
} }
@ -73,8 +78,7 @@ export async function handleResponse(node, result, res) {
} }
else { else {
res.status(result.status).send(result.data); res.status(result.status).send(result.data);
res.end(); res.end();
return;
} }
} }
@ -112,10 +116,15 @@ export async function getUsedResources(req, resourceMeta) {
} }
export async function getDiskInfo(node, type, vmid, disk) { export async function getDiskInfo(node, type, vmid, disk) {
let config = await requestPVE(`/nodes/${node}/${type}/${vmid}/config`, "GET", null, null, pveAPIToken); try {
let storageID = config.data.data[disk].split(":")[0]; let config = await requestPVE(`/nodes/${node}/${type}/${vmid}/config`, "GET", null, null, pveAPIToken);
let volID = config.data.data[disk].split(",")[0]; let storageID = config.data.data[disk].split(":")[0];
let volInfo = await requestPVE(`/nodes/${node}/storage/${storageID}/content/${volID}`, "GET", null, null, pveAPIToken); let volID = config.data.data[disk].split(",")[0];
volInfo.data.data.storage = storageID; let volInfo = await requestPVE(`/nodes/${node}/storage/${storageID}/content/${volID}`, "GET", null, null, pveAPIToken);
return volInfo.data.data; volInfo.data.data.storage = storageID;
return volInfo.data.data;
}
catch {
return null;
}
} }