olsrd: reject non-address input before eval in olsrd-neigh.sh

olsrd-neigh.sh builds shell variable names from data announced by
other nodes in the mesh and passes them through eval:

    eval IP_${ip//[.:]/_}="$hostname"

eval re-parses the string after the quotes have been consumed by the
first expansion pass, so a hostname of `x;reboot` announced by a
remote node is executed as a command on every node that runs the
utility. The values come from the nameservice plugin's hosts file
and from the txtinfo plugin, both of which carry unauthenticated
remote input.

Discard entries containing anything other than the characters that
can legitimately appear in an address or hostname before they reach
eval, in both places.

Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <redacted>
Co-authored-by: Claude Fable 5 <redacted>

diff --git a/net/olsrd/files/olsrd-neigh.sh b/net/olsrd/files/olsrd-neigh.sh
index 65a32a6b4636273039a7ad1798dee073ed974dc4..bf78f51a5b87c8017ea37263070e66de228dad67 100755 (executable)
--- a/net/olsrd/files/olsrd-neigh.sh
+++ b/net/olsrd/files/olsrd-neigh.sh
@@ -50,6 +50,11 @@ read_hostnames()
                                        ip="$1"
                                        hostname="$2"
 
+                                       # both values are announced by other nodes in the
+                                       # mesh, so reject anything that is not a plain
+                                       # address/hostname before it reaches eval
+                                       case "$ip$hostname" in *[!A-Za-z0-9.:_-]*) continue ;; esac
+
                                        # global vars, e.g.
                                        # IP_1_2_3_4='foo' or IP_2001_ffff_ffff_ffff__1='bar'
                                        eval IP_${ip//[.:]/_}="$hostname"
@@ -89,6 +94,12 @@ for HOST in '127.0.0.1' '::1';do
                        i=1;while json_is_a ${i} object;do
                                json_select ${i}
                                json_get_vars $(for v in ${VARS};do echo ${v%:*};done)
+
+                               # remoteIP is announced by other nodes in the mesh and
+                               # is interpolated into a variable name below, so reject
+                               # anything that is not a plain address
+                               case "$remoteIP" in *[!A-Za-z0-9.:_-]*) remoteIP= ;; esac
+
                                case ${j} in 0)
                                        for v in ${VARS};do
                                                eval "test \${_${v%:*}} -lt \${#${v%:*}} && _${v%:*}=\${#${v%:*}}"