luci-app-tailscale-community: fix shell code injections through login params

While individual user supplied credential values were properly shell quoted,
the entire constructed command line got passed to `/bin/sh -c "..."`, enabling
interpolation of nested `$(...)` and backtick expressions.

Solve the issue by passing the final command string as properly escaped,
single quoted expression to the shell.

A more thorough fix would be using `system([...])` with an array vector
but since I neither can test, nor understand the reason for the shell
`&` background operation, I cannot easily fix this.

See https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35.

Signed-off-by: Jo-Philipp Wich <redacted>

diff --git a/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc b/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
index 8e2b7aa56a0b37c0cf392fc4c182d6ae1167e858..b7bf94b0baff7817dad2a010b04e1ba293d59733 100755 (executable)
--- a/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
+++ b/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
@@ -161,7 +161,7 @@ methods.do_login = {
 
                // Run the command in the background using /bin/sh -c to handle the '&' correctly
                let login_cmd = 'tailscale login '+join(' ', loginargs);
-               popen('/bin/sh -c "' + login_cmd + ' &"', 'r');
+               popen('/bin/sh -c ' + shell_quote(login_cmd + ' &'), 'r');
 
                // --- 2. Loop to Check Status for URL ---
                let max_attempts = 15;