uci: tighten uci add operation error handling

[project/rpcd.git] / uci.c

diff --git a/uci.c b/uci.c
index a1b83117abaed2823193ab110bfd4d211cf02d38..5f26dbd625f309e3773784ce85f9db715e3cb963 100644 (file)
--- a/uci.c
+++ b/uci.c
@@ -181,6 +181,60 @@ static const struct blobmsg_policy rpc_uci_rollback_policy[__RPC_B_MAX] = {
                                                .type = BLOBMSG_TYPE_STRING },
 };
 
+/*
+ * Validate a uci name
+ */
+static bool
+rpc_uci_verify_str(const char *name, bool extended, bool type)
+{
+       const char *c;
+       char *e;
+
+       if (!name || !*name)
+               return false;
+
+       if (extended && *name != '@')
+               extended = false;
+
+       for (c = name + extended; *c; c++)
+               if (!isalnum(*c) && *c != '_' && ((!type && !extended) || *c != '-'))
+                       break;
+
+       if (extended) {
+               if (*c != '[')
+                       return false;
+
+               strtol(++c, &e, 10);
+
+               return (e > c && *e == ']' && *(e+1) == 0);
+       }
+
+       return (*c == 0);
+}
+
+/*
+ * Check that string is a valid, shell compatible uci name
+ */
+static bool rpc_uci_verify_name(const char *name) {
+       return rpc_uci_verify_str(name, false, false);
+}
+
+/*
+ * Check that string is a valid section type name
+ */
+static bool rpc_uci_verify_type(const char *type) {
+       return rpc_uci_verify_str(type, false, true);
+}
+
+/*
+ * Check that the string is a valid section id, optionally in extended
+ * lookup notation
+ */
+static bool rpc_uci_verify_section(const char *section) {
+       return rpc_uci_verify_str(section, true, false);
+}
+
+
 /*
  * Turn uci error state into ubus return code
  */
@@ -633,7 +687,7 @@ rpc_uci_add(struct ubus_context *ctx, struct ubus_object *obj,
        struct uci_package *p = NULL;
        struct uci_section *s;
        struct uci_ptr ptr = { 0 };
-       int rem, rem2;
+       int rem, rem2, err = 0;
 
        blobmsg_parse(rpc_uci_add_policy, __RPC_A_MAX, tb,
                      blob_data(msg), blob_len(msg));
@@ -644,6 +698,13 @@ rpc_uci_add(struct ubus_context *ctx, struct ubus_object *obj,
        if (!rpc_uci_write_access(tb[RPC_A_SESSION], tb[RPC_A_CONFIG]))
                return UBUS_STATUS_PERMISSION_DENIED;
 
+       if (!rpc_uci_verify_type(blobmsg_data(tb[RPC_A_TYPE])))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (tb[RPC_A_NAME] &&
+           !rpc_uci_verify_name(blobmsg_data(tb[RPC_A_NAME])))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
        ptr.package = blobmsg_data(tb[RPC_A_CONFIG]);
 
        if (uci_load(cursor, ptr.package, &p))
@@ -676,35 +737,69 @@ rpc_uci_add(struct ubus_context *ctx, struct ubus_object *obj,
                        ptr.o = NULL;
                        ptr.option = blobmsg_name(cur);
 
+                       if (!rpc_uci_verify_name(ptr.option))
+                       {
+                               if (!err)
+                                       err = UBUS_STATUS_INVALID_ARGUMENT;
+
+                               continue;
+                       }
+
                        if (rpc_uci_lookup(&ptr) || !ptr.s)
+                       {
+                               if (!err)
+                                       err = UBUS_STATUS_NOT_FOUND;
+
                                continue;
+                       }
 
                        switch (blobmsg_type(cur))
                        {
                        case BLOBMSG_TYPE_ARRAY:
                                blobmsg_for_each_attr(elem, cur, rem2)
-                                       if (rpc_uci_format_blob(elem, &ptr.value))
-                                               uci_add_list(cursor, &ptr);
+                               {
+                                       if (!rpc_uci_format_blob(elem, &ptr.value))
+                                       {
+                                               if (!err)
+                                                       err = UBUS_STATUS_INVALID_ARGUMENT;
+
+                                               continue;
+                                       }
+
+                                       uci_add_list(cursor, &ptr);
+                               }
+
                                break;
 
                        default:
-                               if (rpc_uci_format_blob(cur, &ptr.value))
+                               if (!rpc_uci_format_blob(cur, &ptr.value))
+                               {
+                                       if (!err)
+                                               err = UBUS_STATUS_INVALID_ARGUMENT;
+                               }
+                               else
+                               {
                                        uci_set(cursor, &ptr);
+                               }
+
                                break;
                        }
                }
        }
 
-       uci_save(cursor, p);
+       if (!err)
+       {
+               uci_save(cursor, p);
 
-       blob_buf_init(&buf, 0);
-       blobmsg_add_string(&buf, "section", ptr.section);
-       ubus_send_reply(ctx, req, buf.head);
+               blob_buf_init(&buf, 0);
+               blobmsg_add_string(&buf, "section", ptr.section);
+               ubus_send_reply(ctx, req, buf.head);
+       }
 
 out:
        uci_unload(cursor, p);
 
-       return rpc_uci_status();
+       return err ? err : rpc_uci_status();
 }
 
 /*
@@ -726,6 +821,9 @@ rpc_uci_merge_set(struct blob_attr *opt, struct uci_ptr *ptr)
        ptr->option = blobmsg_name(opt);
        ptr->value = NULL;
 
+       if (!rpc_uci_verify_name(ptr->option))
+               return;
+
        if (rpc_uci_lookup(ptr) || !ptr->s)
                return;
 
@@ -774,6 +872,10 @@ rpc_uci_set(struct ubus_context *ctx, struct ubus_object *obj,
        if (!rpc_uci_write_access(tb[RPC_S_SESSION], tb[RPC_S_CONFIG]))
                return UBUS_STATUS_PERMISSION_DENIED;
 
+       if (tb[RPC_S_SECTION] &&
+           !rpc_uci_verify_section(blobmsg_data(tb[RPC_S_SECTION])))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
        ptr.package = blobmsg_data(tb[RPC_S_CONFIG]);
 
        if (uci_load(cursor, ptr.package, &p))
@@ -937,6 +1039,9 @@ rpc_uci_rename(struct ubus_context *ctx, struct ubus_object *obj,
        ptr.section = blobmsg_data(tb[RPC_R_SECTION]);
        ptr.value   = blobmsg_data(tb[RPC_R_NAME]);
 
+       if (!rpc_uci_verify_name(ptr.value))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
        if (tb[RPC_R_OPTION])
                ptr.option = blobmsg_data(tb[RPC_R_OPTION]);