Found by reading the code while testing v1.1.0-RC8-2-g23a2bb6. Not reproduced on a board.
A Wi-Fi passphrase containing ' breaks the settings written to the new image
runInstallFinishedCommands builds:
"WIFI_SSID='" + options.WifiSSID + "'\n" +
"WIFI_PSK='" + options.WifiPSK + "'"
and passes it to save-settings. A valid WPA passphrase such as it's-my-wifi produces WIFI_PSK='it's-my-wifi'. Whatever sources that file then gets a syntax error or a wrong value, and it is an injection point into a file sourced as root on the flashed image. Same for SSIDs with '.
Several responses on one request
The same handler calls sendResponse(w, err) after each failing cmdRotateScreen without returning, then again at the end. One failed rotate gives several JSON bodies on one response and a superfluous response.WriteHeader warning. The client sees unparseable JSON.
Suggest: escape with '\'' (or write key=value without shell quoting), and return after the first error, or collect errors and respond once.
Found by reading the code while testing v1.1.0-RC8-2-g23a2bb6. Not reproduced on a board.
A Wi-Fi passphrase containing
'breaks the settings written to the new imagerunInstallFinishedCommandsbuilds:and passes it to
save-settings. A valid WPA passphrase such asit's-my-wifiproducesWIFI_PSK='it's-my-wifi'. Whatever sources that file then gets a syntax error or a wrong value, and it is an injection point into a file sourced as root on the flashed image. Same for SSIDs with'.Several responses on one request
The same handler calls
sendResponse(w, err)after each failingcmdRotateScreenwithout returning, then again at the end. One failed rotate gives several JSON bodies on one response and asuperfluous response.WriteHeaderwarning. The client sees unparseable JSON.Suggest: escape with
'\''(or write key=value without shell quoting), and return after the first error, or collect errors and respond once.