Rework the parameter handling to both prevent a crash when no parameter is
given and to prevent root command injection through the mtd index part of
the parameter value.
Fixes: 9840d310e ("modules: add backup module for mtdblock devices")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
end
function action_backupmtdblock()
- local http = require "luci.http"
- local mv = http.formvalue("mtdblockname")
- local m, s, n = mv:match('^([^%s]+)/([^%s]+)/([^%s]+)')
+ local mv = luci.http.formvalue("mtdblockname") or ""
+ local m, n = mv:match('^([^%s%./"]+)/%d+/(%d+)$')
+
+ if not m and n then
+ luci.http.status(400, "Bad Request")
+ return
+ end
local reader = ltn12_popen("dd if=/dev/mtd%s conv=fsync,notrunc 2>/dev/null" % n)