ser2net: filter non-printable characters from custom options

The custom options are designed to carry only scalar options to be
added to the connector line.

This fixes a security issue when newlines are included in custom options
which can be used to add yet another, arbitrary connector lines.

See https://github.com/openwrt/packages/security/advisories/GHSA-w6q2-vr4f-49x3

Signed-off-by: Michael Heimpold <redacted>

diff --git a/net/ser2net/Makefile b/net/ser2net/Makefile
index ff86e367b9598389323153e299e09ba24112765c..d4b63b474a790621b0b7555ef1d2c3b86739f3f9 100644 (file)
--- a/net/ser2net/Makefile
+++ b/net/ser2net/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ser2net
 PKG_VERSION:=4.6.2
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@SF/ser2net

diff --git a/net/ser2net/files/ser2net.init b/net/ser2net/files/ser2net.init
index 5453ca380adfb135882f30fafd6e139b507703e7..8a54c96c30a07a416966c127583fc0f4bc4bf8c4 100644 (file)
--- a/net/ser2net/files/ser2net.init
+++ b/net/ser2net/files/ser2net.init
@@ -15,6 +15,9 @@ list_cb_append() {
        local value="$1"
        local sep="${3:-,}"
 
+       # keep only printable ASCII characters (space through ~)
+       value="$(LC_ALL=C printf '%s' "$value" | tr -cd ' -~')"
+
        eval "export ${NO_EXPORT:+-n} -- \"$var=\${$var:+\${$var}\${value:+\$sep}}\$value\""
 }