From 89b3643c815c26220bc6db0be824d71de97e26dc Mon Sep 17 00:00:00 2001 From: azerom960 Date: Tue, 29 Sep 2026 23:25:13 -0400 Subject: [PATCH 1/6] RDKEMW-25984: Remove GET parameter support to prevent CSRF in ajaxSet_wireless_network_configuration Remove GET parameter support for configInfo in both ajaxSet_wireless_network_configuration.jst and ajaxSet_wireless_network_configuration_onewifi.jst. This prevents CSRF attacks where an attacker could use GET requests to trigger WiFi configuration changes (WPS PushButton, MAC filter rewrite) via cross-site image tags or similar techniques. The endpoint now only accepts POST requests. Adds a focused security regression test that verifies GET support is removed. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../ajaxSet_wireless_network_configuration.jst | 5 +++-- .../ajaxSet_wireless_network_configuration_onewifi.jst | 5 +++-- tests/ajaxSet_wireless_csrf_test.sh | 10 ++++++++++ 3 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 tests/ajaxSet_wireless_csrf_test.sh diff --git a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst index 8c97792..1403a2e 100644 --- a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst +++ b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst @@ -59,8 +59,9 @@ function validFilterParam($ft){ } if ($_POST['configInfo']) { $jsConfig = $_POST['configInfo']; -} else if ($_GET['configInfo']){ - $jsConfig = rawurldecode($_GET['configInfo']); +} else { + echo('{"error":"configInfo parameter required"}'); + exit(0); } //$jsConfig = '{"ssid_number":"1", "ft":[["1","2"],["c","d"]], "target":"save_filter"}'; $arConfig = json_decode($jsConfig, true); diff --git a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst index f19ccf4..a283cec 100644 --- a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst +++ b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst @@ -68,8 +68,9 @@ function validFilterParam($ft){ } if ($_POST['configInfo']) { $jsConfig = $_POST['configInfo']; -} else if ($_GET['configInfo']){ - $jsConfig = rawurldecode($_GET['configInfo']); +} else { + echo('{"error":"configInfo parameter required"}'); + exit(0); } //$jsConfig = '{"ssid_number":"1", "ft":[["1","2"],["c","d"]], "target":"save_filter"}'; diff --git a/tests/ajaxSet_wireless_csrf_test.sh b/tests/ajaxSet_wireless_csrf_test.sh new file mode 100644 index 0000000..4c5ef91 --- /dev/null +++ b/tests/ajaxSet_wireless_csrf_test.sh @@ -0,0 +1,10 @@ +#!/bin/sh +if grep -q "\$_GET\['configInfo'\]" source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst; then + echo "FAIL: GET support still present in ajaxSet_wireless_network_configuration.jst" + exit 1 +fi +if grep -q "\$_GET\['configInfo'\]" source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst; then + echo "FAIL: GET support still present in ajaxSet_wireless_network_configuration_onewifi.jst" + exit 1 +fi +echo "PASS: GET support removed from both files" From 7a352043ad362d7c3ae971543d09758ae0e1f925 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 01:13:51 -0400 Subject: [PATCH 2/6] RDKEMW-25984: Trigger fresh CI run to clear stale pr-lint checks Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> From 2f19333d30bce927e49756b0051fedc9a5e4918e Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 01:18:43 -0400 Subject: [PATCH 3/6] RDKEMW-25984: Trigger fresh CI run to clear stale pr-lint checks Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com] From d4a8861e08779ce05878bf6415642701afdcc7b0 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 02:00:30 -0400 Subject: [PATCH 4/6] RDKEMW-25984: Trigger fresh CI run to clear stale pr-lint checks Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> From e835dc9c3ef621491fca5b84baad407d2a4323d1 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 02:03:22 -0400 Subject: [PATCH 5/6] RDKEMW-25984: Trigger fresh CI run to clear stale pr-lint checks (retry) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> From c5ad65ce485e68e7eef57d2b31450d6790f94586 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 02:06:01 -0400 Subject: [PATCH 6/6] RDKEMW-25984: Trigger fresh CI run to clear stale pr-lint checks (final retry) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>