Sec/security hardening

application/qmodem/files/usr/share/qmodem/modem_ctrl.sh

@@ -61,7 +61,7 @@ get_sms(){
     if [ ! -f $cache_file ] || [ $(($current_time - $file_time)) -gt $cache_timeout ]; then
         touch $cache_file
         #sms_tool_q -d $at_port -j recv > $cache_file
-        tom_modem $use_ubus_flag  -d $at_port -o r > $cache_file
+        tom_modem $use_ubus_flag  -d "$at_port" -o r > $cache_file
         echo $(cat $cache_file ; json_dump) | jq -s 'add'
     else
         echo $(cat $cache_file ; json_dump) | jq -s 'add'
@@ -158,7 +158,7 @@ case $method in
         index=$3
         [ -n "$sms_at_port" ] && at_port=$sms_at_port
         for i in $index; do
-            tom_modem $use_ubus_flag  -d $at_port -o d -i $i
+            tom_modem $use_ubus_flag  -d "$at_port" -o d -i "$i"
             touch /tmp/cache_sms_$2
             if [ "$?" == 0 ]; then
                 json_add_string status "1"
@@ -243,7 +243,7 @@ case $method in
     "send_at")
         cmd=$(echo "$3" | jq -r '.at')
         port=$(echo "$3" | jq -r '.port')
-        res=$(at $port $cmd)
+        res=$(at "$port" "$cmd")
         json_add_object at_cfg
         if [ "$?" == 0 ]; then
             json_add_string status "1"
@@ -256,7 +256,7 @@ case $method in
     "send_raw_pdu")
         cmd=$3
         [ -n "$sms_at_port" ] && at_port=$sms_at_port
-        res=$(tom_modem $use_ubus_flag  -d $at_port -o s -p "$cmd")
+        res=$(tom_modem $use_ubus_flag  -d "$at_port" -o s -p "$cmd")
         json_select result
         if [ "$?" == 0 ]; then
             json_add_string status "1"
@@ -271,7 +271,7 @@ case $method in
         phone_number=$(echo $cmd_json | jq -r '.phone_number')
         message_content=$(echo $cmd_json | jq -r '.message_content')
         [ -n "$sms_at_port" ] && at_port=$sms_at_port
-        sms_tool_q -d $at_port send "$phone_number" "$message_content" > /dev/null
+        sms_tool_q -d "$at_port" send "$phone_number" "$message_content" > /dev/null
         json_select result
         if [ "$?" == 0 ]; then
             json_add_string status "1"

application/qmodem/files/usr/share/qmodem/modem_util.sh

@@ -4,28 +4,28 @@
 
 at()
 {
-  local at_port=$1
+  local at_port="$1"
   local new_str="${2/[$]/$}"
   local atcmd="${new_str/\"/\"}"
   [ "$clear_buffer" == "1" ] && options="$options -M"
   #过滤空行
   if [ "$(uci get qmodem.main.at_tool 2>/dev/null)" == "1" ]; then
-   sms_tool_q -d $at_port at "$atcmd"
+   sms_tool_q -d "$at_port" at "$atcmd"
   else
-   tom_modem $use_ubus_flag  -d $at_port -o a -c "$atcmd" $options
+   tom_modem $use_ubus_flag  -d "$at_port" -o a -c "$atcmd" $options
   fi
 }
 
 fastat()
 {
-  local at_port=$1
+  local at_port="$1"
   local new_str="${2/[$]/$}"
   local atcmd="${new_str/\"/\"}"
   #过滤空行
   if [ "$(uci get qmodem.main.at_tool 2>/dev/null)" == "1" ]; then
-   sms_tool_q -t 1 -d $at_port at "$atcmd"
+   sms_tool_q -t 1 -d "$at_port" at "$atcmd"
   else
-   tom_modem -d $at_port -o a -c "$atcmd" -t 1
+   tom_modem -d "$at_port" -o a -c "$atcmd" -t 1
   fi
 }
 

luci/luci-app-qmodem-hc/luasrc/controller/qmodem_hc.lua

@@ -56,25 +56,30 @@ function setSIM()
     local sim_gpio = "/sys/class/gpio/sim/value"
     local modem_gpio = "/sys/class/gpio/4g/value"
     local sim_slot = http.formvalue("slot")
+    if sim_slot ~= "SIM1" and sim_slot ~= "SIM2" then
+        luci.http.status(400, "Bad Request")
+        return writeJsonResponse("Invalid", "Invalid")
+    end
+
     local pre_detect = getSimSlot(sim_gpio)
 
     local reset_module = 1
     if pre_detect == sim_slot then
         reset_module = 0
     end
     if sim_slot == "SIM1" then
-        sysfs_cmd = "echo 1 >"..sim_gpio
+        sysfs_value = "1"
         fw_setenv_cmd = "fw_setenv sim2"
     elseif sim_slot == "SIM2" then
-        sysfs_cmd = "echo 0 >"..sim_gpio
+        sysfs_value = "0"
         fw_setenv_cmd = "fw_setenv sim2 1"
     end
-    shell(sysfs_cmd)
+    fs.writefile(sim_gpio, sysfs_value)
     shell(fw_setenv_cmd)
     if reset_module == 1 then
-        shell("echo 0 >"..modem_gpio)
+        fs.writefile(modem_gpio, "0")
         os.execute("sleep 1")
-        shell("echo 1 >"..modem_gpio)
+        fs.writefile(modem_gpio, "1")
     end
     local current_slot = getSimSlot(sim_gpio)
     local nextboot_slot = getNextBootSlot()

luci/luci-app-qmodem-next/htdocs/luci-static/resources/qmodem/sms-pdu.js

@@ -426,8 +426,8 @@ class LuciTable{
             var left = data.left;
             var right = data.right;
             //clear the row
-            this.rows[index].left.innerHTML = "";
-            this.rows[index].right.innerHTML = "";
+            this.rows[index].left.textContent = "";
+            this.rows[index].right.textContent = "";
             //set the row
             this.rows[index].left.appendChild(left);
             this.rows[index].right.appendChild(right);
@@ -441,8 +441,8 @@ class LuciTable{
 
 
         set title(value){
-            this.legend.innerHTML = value;
-            this.title_span.innerHTML = value;
+            this.legend.textContent = value;
+            this.title_span.textContent = value;
         }
 
         set object_data(value){
@@ -476,8 +476,8 @@ class LuciTable{
             }
             var index = 0;
             for (var key in value) {
-                this.rows[index].left.innerHTML = key;
-                this.rows[index].right.innerHTML = value[key];
+                this.rows[index].left.textContent = key;
+                this.rows[index].right.textContent = value[key];
                 index++;
             }
         }

luci/luci-app-qmodem-next/root/usr/share/rpcd/ucode/qmodem_sms

@@ -7,6 +7,60 @@ import { cursor } from 'uci';
 const TOM_MODEM_PATH = '/usr/bin/tom_modem';
 const DEFAULT_SMS_DB_DIR = '/etc/qmodem';
 
+function shellQuote(value) {
+	value = `${value ?? ''}`;
+	let quoted = "'";
+	for (let i = 0; i < length(value); i++) {
+		let ch = substr(value, i, 1);
+		quoted += ch == "'" ? "'\\''" : ch;
+	}
+	return quoted + "'";
+}
+
+function hasOnlyChars(value, allowed) {
+	value = `${value ?? ''}`;
+	for (let i = 0; i < length(value); i++) {
+		if (index(allowed, substr(value, i, 1)) < 0)
+			return false;
+	}
+	return true;
+}
+
+function isSafeToken(value) {
+	value = `${value ?? ''}`;
+	if (!value || length(value) > 64)
+		return false;
+	return hasOnlyChars(value, 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-');
+}
+
+function isSafePath(value) {
+	value = `${value ?? ''}`;
+	if (!value || length(value) > 128 || substr(value, 0, 1) != '/')
+		return false;
+
+	if (index(value, '..') >= 0)
+		return false;
+	return hasOnlyChars(value, 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789/_-.');
+}
+
+function isSafePdu(value) {
+	value = `${value ?? ''}`;
+	if (!value || length(value) > 2048)
+		return false;
+	return hasOnlyChars(value, '0123456789ABCDEFabcdef');
+}
+
+function isNonNegativeInteger(value) {
+	value = `${value ?? ''}`;
+	if (!value || length(value) > 10)
+		return false;
+	return hasOnlyChars(value, '0123456789');
+}
+
+function isSmsStorage(value) {
+	return value == 'ME' || value == 'SM' || value == 'MT';
+}
+
 // Initialize SMS database
 function initSmsDb(db_path, config_section) {
 	let db_dir = db_path;
@@ -17,7 +71,7 @@ function initSmsDb(db_path, config_section) {
 		stat(db_dir);
 	} catch (e) {
 		try {
-			system(`mkdir -p ${db_dir}`);
+			system(`mkdir -p ${shellQuote(db_dir)}`);
 		} catch (err) {
 			warn(`Failed to create directory ${db_dir}: ${err}\n`);
 			return false;
@@ -59,7 +113,7 @@ function initReceivedSmsDb(db_path, config_section) {
 		stat(db_dir);
 	} catch (e) {
 		try {
-			system(`mkdir -p ${db_dir}`);
+			system(`mkdir -p ${shellQuote(db_dir)}`);
 		} catch (err) {
 			warn(`Failed to create directory ${db_dir}: ${err}\n`);
 			return false;
@@ -185,6 +239,9 @@ function writeReceivedSmsDb(db_path, config_section, data) {
 
 // Get modem configuration from UCI
 function getModemConfig(config_section) {
+	if (!isSafeToken(config_section))
+		return null;
+
 	let ctx = cursor();
 	if (!ctx)
 		return null;
@@ -198,6 +255,9 @@ function getModemConfig(config_section) {
 	let use_ubus = cfg.use_ubus == '1';
 	let sms_db_path = cfg.sms_db_path || DEFAULT_SMS_DB_DIR;
 	let sms_auto_delete_from_sim = cfg.sms_auto_delete_from_sim != '0'; // Default to true
+
+	if (!isSafePath(at_port) || !isSafePath(sms_db_path))
+		return null;
 
 	return {
 		at_port: at_port,
@@ -209,18 +269,30 @@ function getModemConfig(config_section) {
 
 // Execute tom_modem command
 function execTomModem(at_port, use_ubus, operation, params) {
+	if (operation != 'r' && operation != 's' && operation != 'd')
+		return null;
+
+	if (!isSafePath(at_port))
+		return null;
+
 	let cmd = TOM_MODEM_PATH;
 
 	if (use_ubus)
 		cmd += ' -u';
 
-	cmd += ` -d "${at_port}" -o ${operation}`;
+	cmd += ` -d ${shellQuote(at_port)} -o ${operation}`;
 
-	if (params?.pdu)
-		cmd += ` -p "${params.pdu}"`;
+	if (params?.pdu) {
+		if (!isSafePdu(params.pdu))
+			return null;
+		cmd += ` -p ${shellQuote(params.pdu)}`;
+	}
 
-	if (params?.index != null)
+	if (params?.index != null) {
+		if (!isNonNegativeInteger(params.index))
+			return null;
 		cmd += ` -i ${params.index}`;
+	}
 
 	try {
 		let proc = popen(cmd, 'r');
@@ -248,23 +320,15 @@ function execTomModem(at_port, use_ubus, operation, params) {
 
 // Execute AT command directly via tom_modem
 function execAtCommand(at_port, use_ubus, at_cmd) {
+	if (!isSafePath(at_port))
+		return null;
+
 	let cmd = TOM_MODEM_PATH;
 
 	if (use_ubus)
 		cmd += ' -u';
 
-	// Use single quotes to wrap AT command to preserve internal double quotes
-	// Replace any single quotes in the AT command with '\'' to escape them
-	let safe_cmd = '';
-	for (let i = 0; i < length(at_cmd); i++) {
-		let ch = substr(at_cmd, i, 1);
-		if (ch == "'")
-			safe_cmd += "'\\''";
-		else
-			safe_cmd += ch;
-	}
-
-	cmd += ` -d '${at_port}' -o a -c '${safe_cmd}'`;
+	cmd += ` -d ${shellQuote(at_port)} -o a -c ${shellQuote(at_cmd)}`;
 
 	try {
 		let proc = popen(cmd, 'r');
@@ -737,8 +801,6 @@ return {
 				let conversations = groupByConversation(all_messages);
 
 				return {
-					modem_config: config,
-					received_from_sim: received_from_sim,
 					conversations: conversations,
 					total: length(all_messages)
 				};
@@ -1213,6 +1275,9 @@ return {
 
 				if (!mem1 || !mem2)
 					return { error: 'Missing mem1 or mem2 parameter' };
+
+				if (!isSmsStorage(mem1) || !isSmsStorage(mem2) || (mem3 && mem3 != 'Loading' && !isSmsStorage(mem3)))
+					return { error: 'Invalid SMS storage parameter' };
 
 				// Build AT+CPMS command
 				let at_cmd = `AT+CPMS="${mem1}","${mem2}"`;
@@ -1274,9 +1339,9 @@ return {
 				let config = getModemConfig(config_section);
 				if (!config)
 					return { error: 'Failed to get modem configuration' };
-				
+
 				let index = request.args.index;
-				if (index == null || index < 0)
+				if (!isNonNegativeInteger(index))
 					return { error: 'Invalid SMS index' };
 
 				// Delete SMS from SIM card