luci-mod-system: prevent comment injection in mtdbackup endpoint

Rework the parameter handling to both prevent a crash when no parameter is
given and to prevent root command injection through the mtd index part of
the parameter value.

Fixes: 9840d310e ("modules: add backup module for mtdblock devices")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/modules/luci-mod-system/luasrc/controller/admin/system.lua b/modules/luci-mod-system/luasrc/controller/admin/system.lua
index 4e83769ee03c61f2b1176583e03c8a2a0f4a818a..8d9305f4fd7781923834705dea7c8c97ad1a5b49 100644 (file)
--- a/modules/luci-mod-system/luasrc/controller/admin/system.lua
+++ b/modules/luci-mod-system/luasrc/controller/admin/system.lua
@@ -319,9 +319,13 @@ function action_backup()
 end
 
 function action_backupmtdblock()
-       local http = require "luci.http"
-       local mv = http.formvalue("mtdblockname")
-       local m, s, n = mv:match('^([^%s]+)/([^%s]+)/([^%s]+)')
+       local mv = luci.http.formvalue("mtdblockname") or ""
+       local m, n = mv:match('^([^%s%./"]+)/%d+/(%d+)$')
+
+       if not m and n then
+               luci.http.status(400, "Bad Request")
+               return
+       end
 
        local reader = ltn12_popen("dd if=/dev/mtd%s conv=fsync,notrunc 2>/dev/null" % n)