Skip to content
Snippets Groups Projects
Commit e418e847 authored by Reidar Cederqvist's avatar Reidar Cederqvist Committed by Yalu Zhang
Browse files

config_asterisk.sh: filter out any option or list item with new-line

This is to avoid cases where the uci option is directly pushed into the asterisk config without
checking the value, otherwise the value can contain a newline followed by a malicious asterisk config option+value.
Note that '\n' is allowed in the value of an option or list.
parent 33df4db1
No related branches found
No related tags found
1 merge request!119config_asterisk.sh: filter out any option or list item with new-line
......@@ -2046,6 +2046,43 @@ generate_asterisk_config_files() {
WORK_DIR=$(mktemp -p /tmp -d)
mkdir -p $ASTERISK_CONF_DIR
# overload option_cb and list_cb to filter "invalid" values
# if an "invalid" value is found, the value is removed
# this logic is heavily based on functions.sh.
# "invalid" values include a new line
valid(){
[ "${1}" = "${1%%$'\n'*}" ]
}
option_cb(){
local option="$1"
local value="$2"
if ! valid "$value"; then
# set the value of the current "invalid" option to "" in ENV
config_unset "$CONFIG_SECTION" "$option"
fi
}
list_cb(){
local option="$1"
local value="$2"
local current_value new_value
if ! valid "$value"; then
config_get current_value "$CONFIG_SECTION" "$option" "$value"
if [ "$current_value" == "$value" ]; then
new_value=""
else
new_value=${current_value%%$LIST_SEP$value}
fi
# remove the current "invalid" value from the list
config_set "$CONFIG_SECTION" "$option" "$new_value"
config_get len "$CONFIG_SECTION" "${option}_LENGTH" 1
# remove the "invalid" value from the list
config_set "$CONFIG_SECTION" "${option}_LENGTH" $((len-1))
config_unset "$CONFIG_SECTION" "${option}_ITEM$len"
fi
}
# Load config file
echo "Loading UCI config $VOICE_UCI_CONFIG"
config_load $VOICE_UCI_CONFIG
......@@ -2058,6 +2095,9 @@ generate_asterisk_config_files() {
config_load $VOICE_UCI_CONFIG
}
# reset all uci callback functions to avoid issues in later config_load
reset_cb
# Create temporary files from templates
echo "Create temporary files"
create_temp_files
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment