cgi-io, branch master

main, util: fix use-after-free on malformed POST field decoding

2026-07-21T01:13:42Z

postdecode_fields() stores each recognized field value as a pointer into the shared postbuf allocation. When urldecode() fails on a malformed percent escape, the buffer was freed while those value pointers were left in fields[], and the cgi-download, cgi-backup and cgi-exec callers ignored the NULL return and dereferenced the dangling pointers -- a remotely triggerable, authenticated use-after-free read that could bleed freed-heap bytes into attacker-visible response headers. Bail out in every URL-encoded applet when postdecode() returns NULL, and, as defense in depth, clear all value slots before releasing the shared buffer so a caller that ignores the NULL return cannot dereference freed memory. Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-wvhq-qmwj-grj2 Fixes: 3d5aa1436185 ("cgi-io: use dynamic memory for post decoding, support proc files") Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/cgi-io/pull/5 Signed-off-by: Hauke Mehrtens

main: canonicalize exec path before ACL check

2026-06-27T22:59:55Z

cgi-exec had the same canonicalization gap as cgi-download: the executable token was passed to session_access(..., "exec") and execv() without being canonicalized, and the whole-cmdline pre-check could likewise be matched by a traversal. Because rpcd's ACL matcher uses fnmatch() without FNM_PATHNAME, a session granted file/exec on a glob such as /usr/libexec/* could run a binary outside that prefix, e.g. /usr/libexec/../../bin/sh. Canonicalize the leading executable token before the ACL checks and the execv(), and rebuild the whole-cmdline string from the canonical executable so that exact-cmdline ACLs keep matching for canonical input. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/cgi-io/pull/4 Signed-off-by: Hauke Mehrtens

main: canonicalize download path before ACL check

2026-06-27T22:59:43Z

cgi-download passed the raw "path" POST field to session_access() and then to open() without canonicalizing it first. rpcd's ACL matcher uses fnmatch() without FNM_PATHNAME (session.c), so a "../" suffix matches an allowed glob prefix during the ACL check while open() resolves the embedded ".." to a file outside that prefix. As cgi-io runs as root, a session holding the cgi-io download permission plus any wildcard file-read grant could read any root-readable file such as /etc/shadow, bypassing the rpcd file ACL that denies the same read. Canonicalize the requested path with canonicalize_path() before the ACL check and use the result for session_access(), stat() and open(), as cgi-upload and rpcd-mod-file already do. Fixes: GHSA-jw5r-xhf5-2xcq Reported-by: Jan Kahmen Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/cgi-io/pull/4 Signed-off-by: Hauke Mehrtens

main: Add `stderr` option for cgi-exec to redirect stderr to stdout

2025-12-11T11:15:13Z

This feature is used by openwrt/luci#7920 It allows cgi processes to follow real-time output sent to stderr. Closes #2 Signed-off-by: Richard Yu Signed-off-by: Paul Donald Link: https://github.com/openwrt/cgi-io/pull/3 Signed-off-by: Robert Marko

build: require CMake >= 3.10 due to dropped legacy support

2025-10-04T11:44:48Z

CMake version 4.0 and later require minimum version of 3.5 or later. Update to minimum version 3.10 which is the last not deprecated minimum version. CMake 3.10 was released in November 2017 and is included in Ubuntu 18.04. Signed-off-by: Hauke Mehrtens

main: fix two one-byte overreads in header_value()

2022-08-10T19:43:34Z

By passing specially crafted header values, the skip loops in the header_value() function may override the input buffer by one byte each. Reported-by: Jinwei Dong Signed-off-by: Jo-Philipp Wich

Retry splice() syscall on EINTR

2021-09-08T19:48:35Z

The invoked child process might end before the I/O loop finished outputting all data. In such a case, the splice() call might fail with -1/EINTR. Continue looping in such a case. Signed-off-by: Jo-Philipp Wich

tests: add cram based unit tests

2020-10-27T22:03:04Z

For the start with cgi-exec testing. Signed-off-by: Petr Štetiar

tests: add cgi-io built with clang sanitizers

2020-10-27T22:03:04Z

Will be used later for testing. Signed-off-by: Petr Štetiar

Disable session ACLs during unit testing

2020-10-27T22:03:04Z

Otherwise we would need to setup ubus infrastructure etc. Signed-off-by: Petr Štetiar