mitigate some vulnerabilities in disk attach,

handle errors in getDiskInfo as result of nonexistent disk
This commit is contained in:
Arthur Lu 2023-05-18 08:09:18 +00:00
parent e83cf890e7
commit 754e7a018b
2 changed files with 40 additions and 16 deletions

27
main.js
View File

@ -25,7 +25,7 @@ app.get("/api/echo", (req, res) => {
});
app.get("/api/auth", async (req, res) => {
let auth = await checkAuth(req.cookies);
let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
res.status(200).send({ auth: true });
});
@ -115,10 +115,20 @@ app.post("/api/instance/disk/attach", async (req, res) => {
let vmpath = `/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}`;
let auth = await checkAuth(req.cookies, res, vmpath);
if (!auth) { return; }
// get current config and check if unused disk exists
let config = await requestPVE(`${vmpath}/config`, "GET", req.cookies, null, null);
if (!config.data.data[`unused${req.body.source}`]) {
res.status(403).send({ error: `requested disk unused${req.body.source} does not exist` });
res.end();
return;
}
let sourceDisk = config.data.data[`unused${req.body.source}`];
// setup action using source disk info from vm config
let action = {};
action[req.body.disk] = req.body.data;
action[req.body.disk] = sourceDisk;
action = JSON.stringify(action);
let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res);
});
@ -179,7 +189,7 @@ app.post("/api/instance/disk/move", async (req, res) => {
res.end();
return;
}
// create action
let action = { storage: req.body.storage, delete: req.body.delete };
if (req.body.type === "qemu") {
action.disk = req.body.disk
@ -189,6 +199,7 @@ app.post("/api/instance/disk/move", async (req, res) => {
}
action = JSON.stringify(action);
let route = req.body.type === "qemu" ? "move_disk" : "move_volume";
// commit action
let result = await requestPVE(`${vmpath}/${route}`, "POST", req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res);
});
@ -204,6 +215,7 @@ app.post("/api/instance/disk/delete", async (req, res) => {
res.end();
return;
}
// create action
let action = JSON.stringify({ delete: req.body.disk });
let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
@ -227,6 +239,7 @@ app.post("/api/instance/disk/create", async (req, res) => {
return;
}
}
// setup action
let action = {};
if (req.body.disk.includes("ide") && req.body.iso) {
action[req.body.disk] = `${req.body.iso},media=cdrom`;
@ -262,11 +275,12 @@ app.post("/api/instance/network", async (req, res) => {
res.end();
return;
}
// commit action
// setup action
let action = {};
action[`net${req.body.netid}`] = currentNetworkConfig.replace(`rate=${currentNetworkRate}`, `rate=${req.body.rate}`);
action = JSON.stringify(action);
let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res);
});
@ -288,9 +302,10 @@ app.post("/api/instance/resources", async (req, res) => {
res.end();
return;
}
// commit action
// setup action
let action = JSON.stringify({ cores: req.body.cores, memory: req.body.memory });
let method = req.body.type === "qemu" ? "POST" : "PUT";
// commit action
let result = await requestPVE(`${vmpath}/config`, method, req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res);
});
@ -349,8 +364,8 @@ app.post("/api/instance", async (req, res) => {
res.end();
return;
}
// commit action
action = JSON.stringify(action);
// commit action
let result = await requestPVE(`/nodes/${req.body.node}/${req.body.type}`, "POST", req.cookies, action, pveAPIToken);
await handleResponse(req.body.node, result, res);
});

29
pve.js
View File

@ -56,13 +56,18 @@ export async function handleResponse(node, result, res) {
let upid = result.data.data;
while (true) {
let taskStatus = await requestPVE(`/nodes/${node}/tasks/${upid}/status`, "GET", null, null, pveAPIToken);
let taskLog = await requestPVE(`/nodes/${node}/tasks/${upid}/log`, "GET", null, null, pveAPIToken);
if (taskStatus.data.data.status === "stopped" && taskStatus.data.data.exitstatus === "OK") {
res.status(200).send(taskStatus.data.data);
let result = taskStatus.data.data;
result.log = taskLog.data.data;
res.status(200).send(result);
res.end();
return;
}
else if (taskStatus.data.data.status === "stopped") {
res.status(500).send(taskStatus.data.data);
let result = taskStatus.data.data;
result.log = taskLog.data.data;
res.status(500).send(result);
res.end();
return;
}
@ -73,8 +78,7 @@ export async function handleResponse(node, result, res) {
}
else {
res.status(result.status).send(result.data);
res.end();
return;
res.end();
}
}
@ -112,10 +116,15 @@ export async function getUsedResources(req, resourceMeta) {
}
export async function getDiskInfo(node, type, vmid, disk) {
let config = await requestPVE(`/nodes/${node}/${type}/${vmid}/config`, "GET", null, null, pveAPIToken);
let storageID = config.data.data[disk].split(":")[0];
let volID = config.data.data[disk].split(",")[0];
let volInfo = await requestPVE(`/nodes/${node}/storage/${storageID}/content/${volID}`, "GET", null, null, pveAPIToken);
volInfo.data.data.storage = storageID;
return volInfo.data.data;
try {
let config = await requestPVE(`/nodes/${node}/${type}/${vmid}/config`, "GET", null, null, pveAPIToken);
let storageID = config.data.data[disk].split(":")[0];
let volID = config.data.data[disk].split(",")[0];
let volInfo = await requestPVE(`/nodes/${node}/storage/${storageID}/content/${volID}`, "GET", null, null, pveAPIToken);
volInfo.data.data.storage = storageID;
return volInfo.data.data;
}
catch {
return null;
}
}