mirror of https://github.com/openwrt/packages.git
d52765005c
olsrd-neigh.sh builds shell variable names from data announced by
other nodes in the mesh and passes them through eval:
eval IP_${ip//[.:]/_}="$hostname"
eval re-parses the string after the quotes have been consumed by the
first expansion pass, so a hostname of `x;reboot` announced by a
remote node is executed as a command on every node that runs the
utility. The values come from the nameservice plugin's hosts file
and from the txtinfo plugin, both of which carry unauthenticated
remote input.
Discard entries containing anything other than the characters that
can legitimately appear in an address or hostname before they reach
eval, in both places.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| olsrd-neigh.sh | ||
| olsrd.config | ||
| olsrd.pud.position.conf | ||
| olsrd.sgw.speed.conf | ||
| olsrd.sh | ||
| olsrd4.init | ||
| olsrd6.config | ||
| olsrd6.init | ||
| olsrd_secure_key | ||