Resolving the CID:430751 issue

Author: sid-TEL

src/jsruntime.cpp

@@ -59,7 +59,28 @@ int main(int argc, char* argv[])
             appendindex = i-1;
 	    i++;
             if (i < argc) {
-                waylanddisplay = argv[i];
+                // Validate wayland display string to contain only safe characters
+                std::string tempDisplay = argv[i];
+                bool isValid = true;
+                
+                // Check if string is not empty and has reasonable length
+                if (tempDisplay.empty() || tempDisplay.length() > 256) {
+                    isValid = false;
+                }
+                
+                // Allow only alphanumeric, dash, underscore, dot, slash, and colon
+                for (char c : tempDisplay) {
+                    if (!isalnum(c) && c != '-' && c != '_' && c != '.' && c != '/' && c != ':') {
+                        isValid = false;
+                        break;
+                    }
+                }
+                
+                if (isValid) {
+                    waylanddisplay = tempDisplay;
+                } else {
+                    NativeJSLogger::log(WARN, "Invalid wayland display format provided, using default\n");
+                }
             }
         }
 	else if (strcmp(argv[i], "--enableHttp") == 0)
@@ -111,11 +132,7 @@ int main(int argc, char* argv[])
 	i++;
     }
 
-    // CID:430751 - Intentional: waylanddisplay from command line argument
-    // This is a display socket name passed to Wayland compositor, used only for
-    // local display connection. The value is passed to system compositor APIs
-    // which handle validation. No injection risk as it's used as display identifier only.
-    /* coverity[tainted_data] */
+    // waylanddisplay is validated before use (alphanumeric, dash, underscore, dot, slash, colon only)
     std::shared_ptr<NativeJSRenderer> renderer = std::make_shared<NativeJSRenderer>(waylanddisplay);
     if (consoleMode) {
         renderer->setEnvForConsoleMode(moduleSettings);