.type = BLOBMSG_TYPE_STRING },
};
+/*
+ * Validate a uci name
+ */
+static bool
+rpc_uci_verify_str(const char *name, bool extended, bool type)
+{
+ const char *c;
+ char *e;
+
+ if (!name || !*name)
+ return false;
+
+ if (extended && *name != '@')
+ extended = false;
+
+ for (c = name + extended; *c; c++)
+ if (!isalnum(*c) && *c != '_' && ((!type && !extended) || *c != '-'))
+ break;
+
+ if (extended) {
+ if (*c != '[')
+ return false;
+
+ strtol(++c, &e, 10);
+
+ return (e > c && *e == ']' && *(e+1) == 0);
+ }
+
+ return (*c == 0);
+}
+
+/*
+ * Check that string is a valid, shell compatible uci name
+ */
+static bool rpc_uci_verify_name(const char *name) {
+ return rpc_uci_verify_str(name, false, false);
+}
+
+/*
+ * Check that string is a valid section type name
+ */
+static bool rpc_uci_verify_type(const char *type) {
+ return rpc_uci_verify_str(type, false, true);
+}
+
+/*
+ * Check that the string is a valid section id, optionally in extended
+ * lookup notation
+ */
+static bool rpc_uci_verify_section(const char *section) {
+ return rpc_uci_verify_str(section, true, false);
+}
+
+
/*
* Turn uci error state into ubus return code
*/
if (!rpc_uci_write_access(tb[RPC_A_SESSION], tb[RPC_A_CONFIG]))
return UBUS_STATUS_PERMISSION_DENIED;
+ if (!rpc_uci_verify_type(blobmsg_data(tb[RPC_A_TYPE])))
+ return UBUS_STATUS_INVALID_ARGUMENT;
+
+ if (tb[RPC_A_NAME] &&
+ !rpc_uci_verify_name(blobmsg_data(tb[RPC_A_NAME])))
+ return UBUS_STATUS_INVALID_ARGUMENT;
+
ptr.package = blobmsg_data(tb[RPC_A_CONFIG]);
if (uci_load(cursor, ptr.package, &p))
ptr.o = NULL;
ptr.option = blobmsg_name(cur);
+ if (!rpc_uci_verify_name(ptr.option))
+ continue;
+
if (rpc_uci_lookup(&ptr) || !ptr.s)
continue;
ptr->option = blobmsg_name(opt);
ptr->value = NULL;
+ if (!rpc_uci_verify_name(ptr->option))
+ return;
+
if (rpc_uci_lookup(ptr) || !ptr->s)
return;
if (!rpc_uci_write_access(tb[RPC_S_SESSION], tb[RPC_S_CONFIG]))
return UBUS_STATUS_PERMISSION_DENIED;
+ if (tb[RPC_S_SECTION] &&
+ !rpc_uci_verify_section(blobmsg_data(tb[RPC_S_SECTION])))
+ return UBUS_STATUS_INVALID_ARGUMENT;
+
ptr.package = blobmsg_data(tb[RPC_S_CONFIG]);
if (uci_load(cursor, ptr.package, &p))
ptr.section = blobmsg_data(tb[RPC_R_SECTION]);
ptr.value = blobmsg_data(tb[RPC_R_NAME]);
+ if (!rpc_uci_verify_name(ptr.value))
+ return UBUS_STATUS_INVALID_ARGUMENT;
+
if (tb[RPC_R_OPTION])
ptr.option = blobmsg_data(tb[RPC_R_OPTION]);