Release 2.3.0

.github/workflows/pr-lint.yml

@@ -0,0 +1,18 @@
+name: PR Format Check
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: pr-format-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    uses: rdkcentral/build_tools_workflows/.github/workflows/pr-lint.yml@develop

CHANGELOG.md

@@ -4,9 +4,20 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [2.3.0](https://github.com/rdkcentral/javascript-templates/compare/2.2.0...2.3.0)
+
+- RDKB-66032 : Add PR Format Check workflow [`#29`](https://github.com/rdkcentral/javascript-templates/pull/29)
+- RDKB-64641 sets post_data = NULL to keep getPost() unset for file-only multipart bodies [`#27`](https://github.com/rdkcentral/javascript-templates/pull/27)
+- RDKB-64256 fix OOB access in log_syntax_error for malformed include parsing [`#26`](https://github.com/rdkcentral/javascript-templates/pull/26)
+- RDKB-65677 eliminate session_create leaks and strengthen regression coverage [`#24`](https://github.com/rdkcentral/javascript-templates/pull/24)
+- Merge tag '2.2.0' into develop [`d73972d`](https://github.com/rdkcentral/javascript-templates/commit/d73972dcf3281b29682f4561a32904d0eb9611dc)
+
 #### [2.2.0](https://github.com/rdkcentral/javascript-templates/compare/2.1.0...2.2.0)
 
+> 15 June 2026
+
 -  RDKB-65466 : sso validation token [`#19`](https://github.com/rdkcentral/javascript-templates/pull/19)
+- Add changelog for release 2.2.0 [`7323c07`](https://github.com/rdkcentral/javascript-templates/commit/7323c0772b5f6c7f573093bbeca0f4b65bb1e1ef)
 - Merge tag '2.1.0' into develop [`6246ada`](https://github.com/rdkcentral/javascript-templates/commit/6246adaaa950bded6b962e748c7f4058285f0a6f)
 
 #### [2.1.0](https://github.com/rdkcentral/javascript-templates/compare/2.0.0...2.1.0)

source/jst_parser.c

@@ -1,5 +1,5 @@
 /*
  If not stated otherwise in this file or this component's Licenses.txt file the
  following copyright and licenses apply:
 
  Copyright 2018 RDK Management
@@ -129,15 +129,43 @@
 
 static void log_syntax_error(char* err, char* s1, char* cur, char* end)
 {
-  char ch;
+  const char* err_msg;
+  char* line_end;
+  char* src_end;
+  int line_len;
+  int src_len;
 
-  while(cur != end && *cur != '\n' && *cur != '\r')
-    cur++;
+  err_msg = err ? err : "unknown";
+
+  if(!cur || !end)
+  {
+    log_debug_message("syntax error. malformed include: %s\n", err_msg);
+    return;
+  }
+
+  if(cur > end)
+    cur = end;
+
+  if(!s1)
+    s1 = cur;
+
+  line_end = s1;
+  while(line_end < end && *line_end != '\n' && *line_end != '\r')
+    line_end++;
+
+  src_end = cur;
+  while(src_end < end && *src_end != '\n' && *src_end != '\r')
+    src_end++;
+
+  line_len = (int)(line_end - s1);
+  src_len = (int)(src_end - cur);
+
+  if(line_len < 0)
+    line_len = 0;
+  if(src_len < 0)
+    src_len = 0;
 
-  ch = *cur;
-  *cur = 0;
-  log_debug_message("syntax error. malformed include: %s. line: %s src:%s\n", err, s1, cur);
-  *cur = ch;
+  log_debug_message("syntax error. malformed include: %s. line: %.*s src:%.*s\n", err_msg, line_len, s1, src_len, cur);
 }
 
 static void template_write_block(growing_buffer* bufout, template_block* block)

source/jst_post.c

@@ -849,7 +849,10 @@ static void process_multipart_form_data(char* content_data, int content_len, cha
   }
   else
   {
-    post_data = content_data;
+    /* Multipart requests with only file parts have no _POST fields. Keep
+       post_data unset so ccsp_post.getPost() continues to mean name=value&...
+       rather than returning the raw multipart body. */
+    post_data = NULL;
   }
 
   for(i=0; i<parts_len; ++i)

source/jst_session.c

@@ -164,6 +164,12 @@ static duk_ret_t session_create(duk_context *ctx)
   char* session_id = NULL;
 
   session_id = (char*)malloc(SESSION_ID_BYTES_LENGTH+1);
+  if(!session_id)
+  {
+    CosaPhpExtLog("Failed to allocate session_id!\n");
+    RETURN_FALSE;
+  }
+
   n = syscall(SYS_getrandom, bytes, SESSION_ID_BYTES_LENGTH, 0);
   if(n != SESSION_ID_BYTES_LENGTH)
   {
@@ -177,16 +183,27 @@ static duk_ret_t session_create(duk_context *ctx)
     session_id[i] = BYTE_TO_PRINTABLE_HEX_CODE(bytes[i]);
   }
 
+  if(session_identifier)
+  {
+    char filename[SESSION_FILE_MAX_PATH];
+    snprintf(filename, SESSION_FILE_MAX_PATH, "%s/%s", SESSION_TMP_DIR, session_identifier);
+    unlink(filename);
+    free(session_identifier);
+    session_identifier = NULL;
+  }
+
   session_identifier = (char*)malloc(SESSION_ID_LENGTH+1);
   if(!session_identifier)
   {
     CosaPhpExtLog("Failed to allocate session_identifier!\n");
+    free(session_id);
     RETURN_FALSE;
   }
   memset(session_identifier, 0, SESSION_ID_LENGTH+1);
 
   session_id[SESSION_ID_BYTES_LENGTH] = '\0';
   snprintf(session_identifier, SESSION_ID_LENGTH+1, "%s%s", SESSION_PREFIX, session_id);
+  free(session_id);
 
   RETURN_TRUE;
   return 1;

tests/CMakeLists.txt

@@ -73,6 +73,8 @@ add_executable(
   parser_test
   ../tests/parser_test.cpp 
   ../source/jst_parser.c 
+  ../source/jst_post.c
+  ../source/jst_session.c
   ../source/jst_internal.c
   ../source/duktape/duktape.c)
 target_link_libraries(parser_test libgtest libgmock -pthread)