Only allow alphanumerical characters, '-' and '_' in event trigger names
This should help in preventing silly typos like "on foo:"
Test: atest CtsInitTestCases
Test: builds
Bug: 135984674
Change-Id: I6e4e18970e957d25dea9f557f0d31a759fbe6150
diff --git a/init/action_parser.cpp b/init/action_parser.cpp
index 9736824..a8e1e09 100644
--- a/init/action_parser.cpp
+++ b/init/action_parser.cpp
@@ -16,11 +16,14 @@
#include "action_parser.h"
+#include <ctype.h>
+
#include <android-base/properties.h>
#include <android-base/strings.h>
#if defined(__ANDROID__)
#include "property_service.h"
+#include "selinux.h"
#else
#include "host_init_stubs.h"
#endif
@@ -77,6 +80,17 @@
return {};
}
+Result<void> ValidateEventTrigger(const std::string& event_trigger) {
+ if (SelinuxGetVendorAndroidVersion() >= __ANDROID_API_R__) {
+ for (const char& c : event_trigger) {
+ if (c != '_' && c != '-' && !std::isalnum(c)) {
+ return Error() << "Illegal character '" << c << "' in '" << event_trigger << "'";
+ }
+ }
+ }
+ return {};
+}
+
Result<void> ParseTriggers(const std::vector<std::string>& args, Subcontext* subcontext,
std::string* event_trigger,
std::map<std::string, std::string>* property_triggers) {
@@ -103,6 +117,9 @@
if (!event_trigger->empty()) {
return Error() << "multiple event triggers are not allowed";
}
+ if (auto result = ValidateEventTrigger(args[i]); !result) {
+ return result;
+ }
*event_trigger = args[i];
}
diff --git a/init/init_test.cpp b/init/init_test.cpp
index 315d584..9f63e4f 100644
--- a/init/init_test.cpp
+++ b/init/init_test.cpp
@@ -93,6 +93,26 @@
EXPECT_TRUE(expect_true);
}
+TEST(init, WrongEventTrigger) {
+ std::string init_script =
+ R"init(
+on boot:
+pass_test
+)init";
+
+ TemporaryFile tf;
+ ASSERT_TRUE(tf.fd != -1);
+ ASSERT_TRUE(android::base::WriteStringToFd(init_script, tf.fd));
+
+ ActionManager am;
+
+ Parser parser;
+ parser.AddSectionParser("on", std::make_unique<ActionParser>(&am, nullptr));
+
+ ASSERT_TRUE(parser.ParseConfig(tf.path));
+ ASSERT_EQ(1u, parser.parse_error_count());
+}
+
TEST(init, EventTriggerOrder) {
std::string init_script =
R"init(