Skip to content

Commit c293be3

Browse files
committed
feat(security): harden subprocess execution, validate inputs
Resolve absolute paths for proxmox-backup-manager/proxmox-backup-debug and constrain PATH Add stable locale for subprocesses and enforce timeouts for manager/list/show and debug/inspect Introduce safe run_cmd with env/timeout and better timeout error reporting Validate datastore names via regex; reject invalid identifiers Add resolve_search_path to prevent path traversal; ensure paths stay under datastore root Bump version to 2.4.1 and align README version Rationale: reduce supply-chain and injection risks, prevent path escapes, and improve robustness on PBS Linux hosts
1 parent 91660ff commit c293be3

3 files changed

Lines changed: 3 additions & 2 deletions

File tree

PBS_Chunk_Checker.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ def _format_command(cmd: object) -> str:
8585

8686
def clear_console() -> None:
8787
"""Clear the terminal similar to the POSIX 'clear' command."""
88-
# ANSI full reset works for most modern terminals, including modern Windows terminals
88+
# ANSI full reset works for Linux terminal emulators
8989
print("\033c", end="", flush=True)
9090

9191
def format_elapsed(seconds: float) -> str:

README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ It calculates the **real disk space usage** of a specific **namespace**, **VM**,
77

88
This allows accurate insights into space consumption per tenant or object — useful for chargeback, reporting, and storage optimization.
99

10-
**Current version:** 2.4.0 (`./PBS_Chunk_Checker.py --version`)
10+
**Current version:** 2.4.1 (`./PBS_Chunk_Checker.py --version`)
1111

1212
---
1313

@@ -136,6 +136,7 @@ Notes:
136136
## ⚠️ Notes
137137

138138
- The script requires **no additional Python packages** — it uses only built-in modules.
139+
- Runs on **Linux PBS hosts**; other operating systems are not supported.
139140
- It must be executed **directly on a PBS host** because it depends on:
140141
- `proxmox-backup-manager`
141142
- `proxmox-backup-debug`
34.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)