cgi-io, branch master

main: canonicalize exec path before ACL check

2026-06-27T22:59:55Z

cgi-exec had the same canonicalization gap as cgi-download: the executable token was passed to session_access(..., "exec") and execv() without being canonicalized, and the whole-cmdline pre-check could likewise be matched by a traversal. Because rpcd's ACL matcher uses fnmatch() without FNM_PATHNAME, a session granted file/exec on a glob such as /usr/libexec/* could run a binary outside that prefix, e.g. /usr/libexec/../../bin/sh. Canonicalize the leading executable token before the ACL checks and the execv(), and rebuild the whole-cmdline string from the canonical executable so that exact-cmdline ACLs keep matching for canonical input. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/cgi-io/pull/4 Signed-off-by: Hauke Mehrtens

main: canonicalize download path before ACL check

2026-06-27T22:59:43Z

cgi-download passed the raw "path" POST field to session_access() and then to open() without canonicalizing it first. rpcd's ACL matcher uses fnmatch() without FNM_PATHNAME (session.c), so a "../" suffix matches an allowed glob prefix during the ACL check while open() resolves the embedded ".." to a file outside that prefix. As cgi-io runs as root, a session holding the cgi-io download permission plus any wildcard file-read grant could read any root-readable file such as /etc/shadow, bypassing the rpcd file ACL that denies the same read. Canonicalize the requested path with canonicalize_path() before the ACL check and use the result for session_access(), stat() and open(), as cgi-upload and rpcd-mod-file already do. Fixes: GHSA-jw5r-xhf5-2xcq Reported-by: Jan Kahmen Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/cgi-io/pull/4 Signed-off-by: Hauke Mehrtens

main: Add `stderr` option for cgi-exec to redirect stderr to stdout

2025-12-11T11:15:13Z

This feature is used by openwrt/luci#7920 It allows cgi processes to follow real-time output sent to stderr. Closes #2 Signed-off-by: Richard Yu Signed-off-by: Paul Donald Link: https://github.com/openwrt/cgi-io/pull/3 Signed-off-by: Robert Marko

build: require CMake >= 3.10 due to dropped legacy support

2025-10-04T11:44:48Z

CMake version 4.0 and later require minimum version of 3.5 or later. Update to minimum version 3.10 which is the last not deprecated minimum version. CMake 3.10 was released in November 2017 and is included in Ubuntu 18.04. Signed-off-by: Hauke Mehrtens

main: fix two one-byte overreads in header_value()

2022-08-10T19:43:34Z

By passing specially crafted header values, the skip loops in the header_value() function may override the input buffer by one byte each. Reported-by: Jinwei Dong Signed-off-by: Jo-Philipp Wich

Retry splice() syscall on EINTR

2021-09-08T19:48:35Z

The invoked child process might end before the I/O loop finished outputting all data. In such a case, the splice() call might fail with -1/EINTR. Continue looping in such a case. Signed-off-by: Jo-Philipp Wich

tests: add cram based unit tests

2020-10-27T22:03:04Z

For the start with cgi-exec testing. Signed-off-by: Petr Štetiar

tests: add cgi-io built with clang sanitizers

2020-10-27T22:03:04Z

Will be used later for testing. Signed-off-by: Petr Štetiar

Disable session ACLs during unit testing

2020-10-27T22:03:04Z

Otherwise we would need to setup ubus infrastructure etc. Signed-off-by: Petr Štetiar

Add initial GitLab CI support

2020-10-27T22:03:04Z

Uses currently proof-of-concept openwrt-ci[1] in order to: * improve the quality of the codebase in various areas * decrease code review time and help merging contributions faster * get automagic feedback loop on various platforms and tools - out of tree build with OpenWrt SDK on following targets: * ath79-generic * imx6-generic * malta-be * mvebu-cortexa53 - out of tree native build on x86/64 with GCC (versions 8, 9, 10) and Clang 10 - out of tree native x86/64 static code analysis with cppcheck and scan-build from Clang 10 1. https://gitlab.com/ynezz/openwrt-ci/ Signed-off-by: Petr Štetiar