Date: Wed, 20 May 2026 19:40:40 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 9cb0be8381f7 - releng/14.3 - bsdconfig: Make sure that SSID names are properly escaped Message-ID: <6a0e0e38.384cf.2c88939e@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9cb0be8381f7c9ecab5892f4f7277f53b7fcc5f6 commit 9cb0be8381f7c9ecab5892f4f7277f53b7fcc5f6 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-05-12 14:16:46 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-05-20 02:12:20 +0000 bsdconfig: Make sure that SSID names are properly escaped The f_menu_wpa_scan_results() function returns a list of networks discovered by a scan. The untrusted network names are evaluated in f_dialog_menu_wireless_edit. The quoting applied in f_menu_wpa_scan_results() protects against evaluation of something like "$(whoami)" but one can add single quotes to defeat that. Pass the SSID names through f_shell_escape to work around this. Escape single quotes in f_dialog_wireless_edit() and f_menu_wireless_configs() too for consistency. I note that this module doesn't seem to actually work, see e.g., bugzilla PR 229883. Approved by: so Security: FreeBSD-SA-26:23.bsdinstall Security: CVE-2026-45255 Reported by: Austin Ralls Reviewed by: dteske, des Differential Revision: https://reviews.freebsd.org/D56974 --- usr.sbin/bsdconfig/share/media/wlan.subr | 3 +++ 1 file changed, 3 insertions(+) diff --git a/usr.sbin/bsdconfig/share/media/wlan.subr b/usr.sbin/bsdconfig/share/media/wlan.subr index 5847356d1925..5d271c403b3c 100644 --- a/usr.sbin/bsdconfig/share/media/wlan.subr +++ b/usr.sbin/bsdconfig/share/media/wlan.subr @@ -813,6 +813,7 @@ f_dialog_wireless_edit() [ $nmatches -le ${#DIALOG_MENU_TAGS} ] || break f_substr -v tag "$DIALOG_MENU_TAGS" $nmatches 1 + f_shell_escape "$wssid" wssid f_wireless_describe WIRELESS_$n help menu_list1="$menu_list1 '$tag $wssid' '$wbssid' '$help' @@ -1076,6 +1077,7 @@ f_menu_wireless_configs() while [ $n -lt $nunique ]; do n=$(( $n + 1 )) menuitem_$n get ssid ssid + f_shell_escape "$ssid" ssid menuitem_$n get nconfigs nconfigs desc="$nconfigs $msg_configured_lc" @@ -1184,6 +1186,7 @@ f_menu_wpa_scan_results() while [ $n -lt $nunique ]; do n=$(( $n + 1 )) menuitem_$n get ssid ssid + f_shell_escape "$ssid" ssid desc= if [ "$DIALOG_MENU_WLAN_SHOW_ALL" ]; thenhome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a0e0e38.384cf.2c88939e>