From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 73D791CACC; Sat, 29 Nov 2025 09:51:33 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 762D51CA40; Sat, 29 Nov 2025 09:51:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb12d.google.com (mail-yx1-xb12d.google.com [IPv6:2607:f8b0:4864:20::b12d]) by atuin.qyliss.net (Postfix) with ESMTPS id B04521CA2A for ; Sat, 29 Nov 2025 09:51:23 +0000 (UTC) Received: by mail-yx1-xb12d.google.com with SMTP id 956f58d0204a3-6433f99eb15so1589340d50.3 for ; Sat, 29 Nov 2025 01:51:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764409881; x=1765014681; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=fcJ7Q8z48fzq70bwasFFKcIWOVxkDzkjFXC5ppWwv1o=; b=DqOBIQ6f0LLoRC6QAR3SWC/NeywygPDuNW5UkD3jNwLv/s0KP+2qw7oRkOLjrCoXj7 aNZOkh2AHoOahLM4ixZRYR7R5Rmn5vG2P+ogJ6vD22CQ1tqer6BOobXElTJPgGvbMytn ueQtkIdooYkLflNaSGhf56QrPrbx3evJCSghKkRWxMdba7sqA1yhmBeT4jR+6bJgbZM5 cfA6IsZCPD3lx52WO8/khhqRXmFAzDOuSwL+Bu0eQlWYZztMabN8zFixBZ8NGH9XKqfk TJj/PQo1+r98Bx609NojJZGTcGnYAKxlh1bZTOZJcoG8v4SRrrXtJEhF80oLkjQQsYkw OZhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764409881; x=1765014681; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=fcJ7Q8z48fzq70bwasFFKcIWOVxkDzkjFXC5ppWwv1o=; b=NZCN92a6vr+q8UeKZKvjCzoXK+NdLgvsJrg3wTQppD9Z3P6dodXKNKQXxqdLGFAQu4 d+Lbl4fU5W2NKrwrE35b7Lb+pxvuo97Zs0SIhz6NNYps5dAssrXWu54CYEP3j/jbUZUm K3f3PyTaFZBPqKUALbZJsnLhpgFXVPUDcLiO5gCtHiePKEBGUevFwAhXTJSQGvyik6Vv iZQdfnPdRgQjSTYaHv4oIKhSNYTWHmfVnGRxAJI68bPBRYtzKi4l/F/sHFOcSPvR88+C xYQz9gdi3qo+4hV267MvVSGBzFUfzOEpT72jhnxnXIi7u4vyQYPmpCWtDRHWvYWkEQPl DjIg== X-Gm-Message-State: AOJu0YxjFF4/uMbADS5qr8Q6jH+NF0wO6+a6RJrKjZGotivHVZ7RnBLu 2xQsFA/HjI8yiqjLepxJyf+PGJJZkJfWu6R5lBgaLJDVlnt7RNDaDqGJ78tRww== X-Gm-Gg: ASbGncsXcPlA11SvO3ZdTJzvZBatnqnxUG/JZbp0e+yiTWv7NQbSF9ql6GmNSBX2miZ 9xmYxTVMeJPW7BRbtAp3ADm3tIi0U2lBgWjLXlDmijEjYs4J7JmJApaXpLFzApvAmnV5UDIJ0+Y eQsJP1MBSvoqrD02IR7pN7W0K1tGJOGwXpwA6HxxFylFaSzZHOR26+nrQAY+b8+xiz/toDVSaei mGxY7dy6Hj4J9TfkyTy9nnU4KV0c+4n05rkuNTkr/YyXuhLo0VZdtcce5MwBtFbu3917oJ2ramV FsuB+8ISMnzbnCmaC92gjvPozJY0e0F8eqBe3Uglkv9c7okzmcVrFP+239iItBEAGnh4hS0FZya LvnvHkKvDZctyrMpZHkBWJxdeWe/RUjRhUQha72Pq4TC4bbSBY3DcSQSx++ehoh5WPO8joeNhdK t5Jhv0xfTYOUF3tRVQQzu3C8Vo81nYeB2Ye3UWW72GUrBdO3bYSjh4KWmQdhu/SYfo5xHNmblDf 2xqLThCSnQC5SEsTkINhEkjByTaE/lzLCE= X-Google-Smtp-Source: AGHT+IE6ZirLGIptt+QPiz7+qRswYM9W9qMEw9Td1M6/fFGvD8r/850KpQ2CAwEaAYMbp4zFqCMjUQ== X-Received: by 2002:a05:690e:1304:b0:643:86d:745a with SMTP id 956f58d0204a3-643086d74bdmr18657393d50.22.1764409881319; Sat, 29 Nov 2025 01:51:21 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 956f58d0204a3-6433c073e07sm2386054d50.6.2025.11.29.01.51.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 29 Nov 2025 01:51:20 -0800 (PST) From: Demi Marie Obenour Date: Sat, 29 Nov 2025 04:50:05 -0500 Subject: [PATCH v6 8/8] Validate configuration parameters MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251129-updates-v6-8-9edb87a2e509@gmail.com> References: <20251129-updates-v6-0-9edb87a2e509@gmail.com> In-Reply-To: <20251129-updates-v6-0-9edb87a2e509@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1764409797; l=2990; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=qvPSW3IfcDI3Il3Ghg/3OHtIWJibJWBdP5tmvhI3QJY=; b=BcRJeblXku+DnctMSBDtavVNGqKIf8pYB53b9JZS8KUIJ5oxKbK32IRUECxNcBx1svN9XUJg1 L6vkZtc6GNFB/lJlBaPK2bIaXcbWPI0TZjlT7Z9v02WZK2+9sNuM1oR X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: 6ZU7FOSWGABXGMGCZ6DBEGWARKX36FHE X-Message-ID-Hash: 6ZU7FOSWGABXGMGCZ6DBEGWARKX36FHE X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Wrong values for the version or update URL will cause very confusing build-time or runtime errors. Provide a better user experience by validating them up-front. The update URL validator is loose. It rejects only URLs that cannot possibly work: either appending /SHA256SUMS to them doesn't append to the path, or they will definitely be rejected by curl due to being malformed. The version validator is in lib/config.nix, as the version number is used in many places. It checks that the version only uses characters that are permitted by systemd's version number specification [1] and that will not break code that uses them in shell or sed commands. [1]: https://uapi-group.org/specifications/specs/version_format_specification Signed-off-by: Demi Marie Obenour --- Changes since v4: - Drop compression level. - Centralize validation. - Use camelCase for Nix identifiers. - Clean up formatting. Changes since v3: - Validate compression level. Changes since v2: - Use loose URL validation: allow anything that might work. - Only reject versions that violate the specification. --- lib/config.nix | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/lib/config.nix b/lib/config.nix index e437cdbe9aa22dd0f9c8d7052ac331c8fccf6ce6..e641642de07c1549e69fc12e91c4e80e2f82d035 100644 --- a/lib/config.nix +++ b/lib/config.nix @@ -17,6 +17,31 @@ let callConfig = config: if builtins.typeOf config == "lambda" then config { inherit default; } else config; + finalConfig = default // callConfig config; + # Use builtins.fromJSON because it supports \uXXXX escapes. + # This is the same regex used by check-url.awk in the update VM. + # The update code is careful to escape any metacharacters, but some + # simply cannot be made to work. Concatenating the URL with /SHA256SUMS + # must append to the path portion of the URL, and the URL must be one + # that libcurl will accept. + urlRegex = builtins.fromJSON "\"^[^\\u0001- #?\\u007F]+$\""; in -default // callConfig config +# Version is used in many files, so validate it here. +# See https://uapi-group.org/specifications/specs/version_format_specification +# for allowed version strings. +if builtins.match "[[:alnum:]_.~^-]+" finalConfig.version == null then + builtins.abort '' + Version ${builtins.toJSON finalConfig.version} has forbidden characters. + Only ASCII alphanumerics, ".", "_", "~", "^", "+", and "-" are allowed. + See . + '' +else +if builtins.match urlRegex finalConfig.updateUrl == null then + builtins.abort '' + Update URL ${builtins.toJSON finalConfig.updateUrl} has forbidden characters. + Query strings, and fragment specifiers are not supported. + ASCII control characters and whitespace must be %-encoded. + '' +else +finalConfig -- 2.52.0