From abc98f66a5f094c31acbd17530ea7ba3abba14e7 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 00:00:31 -0400 Subject: [PATCH 1/3] RDKEMW-26156: Constrain dial data cache names --- server/gdial-app.c | 15 +++++++++++++++ tests/test_security_dial_data_paths.py | 15 +++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 tests/test_security_dial_data_paths.py diff --git a/server/gdial-app.c b/server/gdial-app.c index bd5c8572..baf7536d 100644 --- a/server/gdial-app.c +++ b/server/gdial-app.c @@ -49,6 +49,18 @@ enum { static GList *application_instances_ = NULL; +static gboolean gdial_app_name_is_safe(const gchar *app_name) { + if (!app_name || !app_name[0] || !g_utf8_validate(app_name, -1, NULL)) { + return FALSE; + } + for (const gchar *cursor = app_name; *cursor; ++cursor) { + if (!(g_ascii_isalnum(*cursor) || *cursor == '.' || *cursor == '_' || *cursor == '-')) { + return FALSE; + } + } + return g_strcmp0(app_name, ".") != 0 && g_strcmp0(app_name, "..") != 0; +} + static guint gdial_app_signals[N_SIGNALS] = {0}; G_DEFINE_TYPE_WITH_PRIVATE(GDialApp, gdial_app, G_TYPE_OBJECT) @@ -408,6 +420,7 @@ GDialApp *gdial_app_find_instance_by_instance_id(gint instance_id) { } GDIAL_STATIC gboolean gdial_app_write_additional_dial_data(const gchar *app_name, const gchar *data, size_t length) { + g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE); gboolean result = FALSE; GError *err = NULL; gchar *filename = g_build_filename(GDIAL_APP_DIAL_DATA_DIR, app_name, NULL); @@ -439,6 +452,7 @@ GDIAL_STATIC gboolean gdial_app_write_additional_dial_data(const gchar *app_name } GDIAL_STATIC gboolean gdial_app_read_additional_dial_data(const gchar *app_name, gchar **data, size_t *length) { + g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE); gboolean result = FALSE; GError *err = NULL; @@ -487,6 +501,7 @@ GDIAL_STATIC gboolean gdial_app_read_additional_dial_data(const gchar *app_name, } GDIAL_STATIC gboolean gdial_app_remove_additional_dial_data_file(const gchar *app_name) { + g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE); gboolean result = FALSE; gchar *filename = g_build_filename(GDIAL_APP_DIAL_DATA_DIR, app_name, NULL); GFile *gfile = g_file_new_for_path(filename); diff --git a/tests/test_security_dial_data_paths.py b/tests/test_security_dial_data_paths.py new file mode 100644 index 00000000..10cdfa71 --- /dev/null +++ b/tests/test_security_dial_data_paths.py @@ -0,0 +1,15 @@ +import pathlib +import unittest + + +class DialDataPathGuardrail(unittest.TestCase): + def test_file_sinks_require_safe_application_names(self): + source = (pathlib.Path(__file__).parents[1] / "server/gdial-app.c").read_text() + self.assertIn("g_ascii_isalnum(*cursor)", source) + self.assertEqual(source.count("g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE);"), 3) + for value in ('*cursor == \'/\'', '*cursor == \'\\\\\''): + self.assertNotIn(value, source[source.index("static gboolean gdial_app_name_is_safe"):source.index("static guint gdial_app_signals")]) + + +if __name__ == "__main__": + unittest.main() From 4c400e1f881b5b29296966ae6778263d993934e5 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 00:31:01 -0400 Subject: [PATCH 2/3] RDKEMW-26156: Use compatible entservices APIs --- build_dependencies.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_dependencies.sh b/build_dependencies.sh index 86d6c353..af4f8403 100755 --- a/build_dependencies.sh +++ b/build_dependencies.sh @@ -36,7 +36,7 @@ git clone --branch R4.4.3 https://github.com/rdkcentral/ThunderTools.git git clone --branch R4.4.1 https://github.com/rdkcentral/Thunder.git -git clone --branch main https://github.com/rdkcentral/entservices-apis.git +git clone --branch topic/RDKEMW-26132 https://github.com/rdkcentral/entservices-apis.git git clone https://$GITHUB_TOKEN@github.com/rdkcentral/entservices-testframework.git From cb6f64363cc01310284e1db3938422cd1436f2bf Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 02:09:48 -0400 Subject: [PATCH 3/3] RDKEMW-26156: Align native build dependencies --- build_dependencies.sh | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/build_dependencies.sh b/build_dependencies.sh index af4f8403..b890ec13 100755 --- a/build_dependencies.sh +++ b/build_dependencies.sh @@ -10,7 +10,7 @@ cd ${GITHUB_WORKSPACE} #1. Install Dependencies and packages apt update -apt install -y ninja-build meson curl libsoup2.4-dev libxml2-dev libglib2.0-dev gobject-introspection libgirepository1.0-dev libgtk-3-dev valac pandoc +apt install -y git python3 python3-pip cmake ninja-build meson curl libsoup2.4-dev libxml2-dev libglib2.0-dev gobject-introspection libgirepository1.0-dev libgtk-3-dev libcurl4-openssl-dev libcunit1-dev valac pandoc pip install jsonref ############################ @@ -28,17 +28,25 @@ cd .. rm -rf iarmbus ThunderTools Thunder entservices-apis entservices-testframework gssdp +THUNDER_TOOLS_COMMIT_SHA="d5dd83c7c19c49c7f25c558c126500bd2d64f7a4" +THUNDER_COMMIT_SHA="2c0fcc5529e7da734be558ca6efa05d934dcce31" git clone https://github.com/rdkcentral/iarmbus.git export IARMBUS_PATH=$GITHUB_WORKSPACE/iarmbus -git clone --branch R4.4.3 https://github.com/rdkcentral/ThunderTools.git +git clone --branch R4_4-RDK https://github.com/rdkcentral/ThunderTools.git +cd ThunderTools +git checkout $THUNDER_TOOLS_COMMIT_SHA +cd .. -git clone --branch R4.4.1 https://github.com/rdkcentral/Thunder.git +git clone --branch R4_4-RDK https://github.com/rdkcentral/Thunder.git +cd Thunder +git checkout $THUNDER_COMMIT_SHA +cd .. -git clone --branch topic/RDKEMW-26132 https://github.com/rdkcentral/entservices-apis.git +git clone --branch develop https://github.com/rdkcentral/entservices-apis.git -git clone https://$GITHUB_TOKEN@github.com/rdkcentral/entservices-testframework.git +git clone --branch 2.0.0 https://github.com/rdkcentral/entservices-testframework.git git clone --branch gssdp-1.2.3 https://gitlab.gnome.org/GNOME/gssdp.git @@ -60,7 +68,6 @@ cd - echo "======================================================================================" echo "buliding thunderTools" cd ThunderTools -patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/00010-R4.4-Add-support-for-project-dir.patch cd - @@ -79,10 +86,6 @@ echo "========================================================================== echo "buliding thunder" cd Thunder -patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/Use_Legact_Alt_Based_On_ThunderTools_R4.4.3.patch -patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/error_code_R4_4.patch -patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/1004-Add-support-for-project-dir.patch -patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/RDKEMW-733-Add-ENTOS-IDS.patch cd - cmake -G Ninja -S Thunder -B build/Thunder \