Using HTML code in VM "notes" causes GUI to show parse errors on any further action

[Jor]

The pve GUI allows you to add simple HTML formatting tags into notes like "br" (with less-than and greater-than) to do some have control over line breaks.
This works: the GUI now shows notes with proper line breaks.

But it breaks pve Option and HArdware settings. Any attempt to change any Hardwaer setting results in "parse error" errors.
All previous pending changes remain pending and are not applied when the VM shuts down.

Either prevent HTML tags in notes or fix the parser to ignore the notes.

I have not even tried to see if this parser flaw can be exploited by unprivileged accounts gaining elevated access by carefully crafted Notes.

 

[JohnnieKF]

What content are you putting in and what exactly does the parse error say?

 

[Jor]

I'm just putting a Page-Break (br) in, like:

first line of notes
<br>
second line of notes

and the action was deleting an IDE CDROM (ide2) pointing to the Windows installation ISO image on a NFS store.

 

[Jor]

And now it's no longer reproducable.
I had removed the <br> in the notes and the Parse error immediately vanished.