RDKEMW-26156: Constrain dial data cache names

build_dependencies.sh

@@ -10,7 +10,7 @@ cd ${GITHUB_WORKSPACE}
 #1. Install Dependencies and packages
 
 apt update
-apt install -y ninja-build meson curl libsoup2.4-dev libxml2-dev libglib2.0-dev gobject-introspection libgirepository1.0-dev libgtk-3-dev valac pandoc
+apt install -y git python3 python3-pip cmake ninja-build meson curl libsoup2.4-dev libxml2-dev libglib2.0-dev gobject-introspection libgirepository1.0-dev libgtk-3-dev libcurl4-openssl-dev libcunit1-dev valac pandoc
 pip install jsonref
 
 ############################
@@ -28,17 +28,25 @@ cd ..
 
 rm -rf iarmbus ThunderTools Thunder entservices-apis entservices-testframework gssdp
 
+THUNDER_TOOLS_COMMIT_SHA="d5dd83c7c19c49c7f25c558c126500bd2d64f7a4"
+THUNDER_COMMIT_SHA="2c0fcc5529e7da734be558ca6efa05d934dcce31"
 
 git clone https://github.com/rdkcentral/iarmbus.git
 export IARMBUS_PATH=$GITHUB_WORKSPACE/iarmbus
 
-git clone --branch  R4.4.3 https://github.com/rdkcentral/ThunderTools.git
+git clone --branch R4_4-RDK https://github.com/rdkcentral/ThunderTools.git
+cd ThunderTools
+git checkout $THUNDER_TOOLS_COMMIT_SHA
+cd ..
 
-git clone --branch R4.4.1 https://github.com/rdkcentral/Thunder.git
+git clone --branch R4_4-RDK https://github.com/rdkcentral/Thunder.git
+cd Thunder
+git checkout $THUNDER_COMMIT_SHA
+cd ..
 
-git clone --branch main https://github.com/rdkcentral/entservices-apis.git
+git clone --branch develop https://github.com/rdkcentral/entservices-apis.git
 
-git clone https://$GITHUB_TOKEN@github.com/rdkcentral/entservices-testframework.git
+git clone --branch 2.0.0 https://github.com/rdkcentral/entservices-testframework.git
 
 git clone --branch gssdp-1.2.3 https://gitlab.gnome.org/GNOME/gssdp.git
 
@@ -60,7 +68,6 @@ cd -
 echo "======================================================================================"
 echo "buliding thunderTools"
 cd ThunderTools
-patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/00010-R4.4-Add-support-for-project-dir.patch
 cd -
 
 
@@ -79,10 +86,6 @@ echo "==========================================================================
 echo "buliding thunder"
 
 cd Thunder
-patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/Use_Legact_Alt_Based_On_ThunderTools_R4.4.3.patch
-patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/error_code_R4_4.patch
-patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/1004-Add-support-for-project-dir.patch
-patch -p1 < $GITHUB_WORKSPACE/entservices-testframework/patches/RDKEMW-733-Add-ENTOS-IDS.patch
 cd -
 
 cmake -G Ninja -S Thunder -B build/Thunder \

server/gdial-app.c

@@ -49,6 +49,18 @@ enum {
 
 static  GList *application_instances_ = NULL;
 
+static gboolean gdial_app_name_is_safe(const gchar *app_name) {
+  if (!app_name || !app_name[0] || !g_utf8_validate(app_name, -1, NULL)) {
+    return FALSE;
+  }
+  for (const gchar *cursor = app_name; *cursor; ++cursor) {
+    if (!(g_ascii_isalnum(*cursor) || *cursor == '.' || *cursor == '_' || *cursor == '-')) {
+      return FALSE;
+    }
+  }
+  return g_strcmp0(app_name, ".") != 0 && g_strcmp0(app_name, "..") != 0;
+}
+
 static guint gdial_app_signals[N_SIGNALS] =  {0};
 
 G_DEFINE_TYPE_WITH_PRIVATE(GDialApp, gdial_app, G_TYPE_OBJECT)
@@ -408,6 +420,7 @@ GDialApp *gdial_app_find_instance_by_instance_id(gint instance_id) {
 }
 
 GDIAL_STATIC gboolean gdial_app_write_additional_dial_data(const gchar *app_name, const gchar *data, size_t length) {
+  g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE);
   gboolean result = FALSE;
   GError *err = NULL;
   gchar *filename = g_build_filename(GDIAL_APP_DIAL_DATA_DIR, app_name, NULL);
@@ -439,6 +452,7 @@ GDIAL_STATIC gboolean gdial_app_write_additional_dial_data(const gchar *app_name
 }
 
 GDIAL_STATIC gboolean gdial_app_read_additional_dial_data(const gchar *app_name, gchar **data, size_t *length) {
+  g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE);
   gboolean result = FALSE;
   GError *err = NULL;
 
@@ -487,6 +501,7 @@ GDIAL_STATIC gboolean gdial_app_read_additional_dial_data(const gchar *app_name,
 }
 
 GDIAL_STATIC gboolean gdial_app_remove_additional_dial_data_file(const gchar *app_name) {
+  g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE);
   gboolean result = FALSE;
   gchar *filename = g_build_filename(GDIAL_APP_DIAL_DATA_DIR, app_name, NULL);
   GFile *gfile = g_file_new_for_path(filename);

tests/test_security_dial_data_paths.py

@@ -0,0 +1,15 @@
+import pathlib
+import unittest
+
+
+class DialDataPathGuardrail(unittest.TestCase):
+    def test_file_sinks_require_safe_application_names(self):
+        source = (pathlib.Path(__file__).parents[1] / "server/gdial-app.c").read_text()
+        self.assertIn("g_ascii_isalnum(*cursor)", source)
+        self.assertEqual(source.count("g_return_val_if_fail(gdial_app_name_is_safe(app_name), FALSE);"), 3)
+        for value in ('*cursor == \'/\'', '*cursor == \'\\\\\''):
+            self.assertNotIn(value, source[source.index("static gboolean gdial_app_name_is_safe"):source.index("static guint gdial_app_signals")])
+
+
+if __name__ == "__main__":
+    unittest.main()