Check validity of config_id when saving WiFi conf

Change-Id: Ie64319a22578b1409017d9e03cbb09a46edbbff6
Signed-off-by: Jaehyun Kim <jeik01.kim@samsung.com>

diff --git a/src/wifi-config.c b/src/wifi-config.c
index 99c6903e6f7bbdad7b6da47aa58175ddb8cefdef..e586835f7638b57490ed5a743ae54b004ddf77f2 100755 (executable)
--- a/src/wifi-config.c
+++ b/src/wifi-config.c
@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <ctype.h>
 #include <sys/types.h>
 #include <dirent.h>
 #include <sys/stat.h>
@@ -52,6 +53,7 @@
 #define MAC_ADDRESS_LENGTH             12
 #define WIFI_PREFIX_LENGTH             MAC_ADDRESS_LENGTH + 6  /* wifi_485a3f2f506a_ */
 #define PROFILE_PREFIX_LENGTH  WIFI_PREFIX_LENGTH + 21 /* /net/connman/service/wifi_485a3f2f506a_ */
+#define WIFI_CONFIG_ID_LENGTH  82 /* SSID(in hex) + "_managed_ieee8021x"  */
 
 #define        NET_DNS_ADDR_MAX                2
 
@@ -1219,6 +1221,27 @@ static unsigned char __netconfig_convert_netmask_to_prefixlen(
        return bits;
 }
 
+static gboolean __netconfig_is_valid_config_id(const gchar *config_id)
+{
+       int length;
+
+       if (!config_id)
+               return FALSE;
+
+       length = strlen(config_id);
+       if (length < 1 || length > WIFI_CONFIG_ID_LENGTH)
+               return FALSE;
+
+       for (int i = 0; i < length; i++) {
+               if (!(islower(config_id[i])) &&
+                               !(isdigit(config_id[i])) &&
+                               config_id[i] != '_')
+                       return FALSE;
+       }
+
+       return TRUE;
+}
+
 gboolean handle_save_configuration(Wifi *wifi, GDBusMethodInvocation *context,
                const gchar *ifname, const gchar *config_id, GVariant *configuration)
 {
@@ -1233,7 +1256,9 @@ gboolean handle_save_configuration(Wifi *wifi, GDBusMethodInvocation *context,
        int rv;
        struct timeval modified_time;
 
-       if ((wifi == NULL) || (config_id == NULL) || (configuration == NULL)) {
+       if ((wifi == NULL) ||
+                       (__netconfig_is_valid_config_id(config_id) == FALSE) ||
+                       (configuration == NULL)) {
                ERR("Invalid parameter");
                netconfig_error_invalid_parameter(context);
                return TRUE;