RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI

[vanemage]

No description provided.

[github-actions]

📋 PR Format Reminder

• Title: RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI — expected TICKET-123 : description
  (Multiple tickets OK: RDKCOM-5492 RDKBDEV-3336 : ... | Include US ticket + subtask for user-stories)
• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

This PR addresses security-vulnerability findings in the XB6 WebUI wireless configuration action handler by tightening input validation and deriving the target Wi‑Fi radio from the SSID’s LowerLayers instead of trusting client-provided indices.

Changes:

• Added ssid_number validation (numeric + must be an existing Device.WiFi.SSID instance) with 400 responses on invalid input.
• Added ResolveRadioFromSsid() to map SSID → Radio via LowerLayers and used that mapping for radio configuration reads/writes.
• Simplified SSID apply logic to apply settings on the resolved radio.

Comments suppressed due to low confidence (2)

source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst:140

• In this branch $i was already parsed/validated above (including handling missing ssid_number). Re-reading $arConfig['ssid_number'] here bypasses that guard and can trigger an undefined-index notice if the key is absent. Reuse the previously validated $i and explicitly reject empty values in this branch.

       $i = String($arConfig['ssid_number']);
       $r = ResolveRadioFromSsid($i);
       if ($r == "") {
		http_response_code(400);
		echo( '{"error":"invalid_ssid_mapping"}');
		exit(0);
	}

source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst:139

• This change makes $i an SSID instance and $r the resolved radio, but later logic in this handler still treats $i as the radio selector in multiple places (e.g. wireless-mode validation branches on $i==1/$i==2 and extension-channel rules use ("2" != $i) while setting Device.WiFi.Radio.$r.*). This will break configuration for SSIDs whose instance id is not the same as the underlying radio (additional SSIDs, future platforms, etc.). The radio-dependent checks/logging should use $r (or a clearly named $radioId) consistently, while SSID/AP paths continue to use $i.

       $r = ResolveRadioFromSsid($i);
       if ($r == "") {
		http_response_code(400);
		echo( '{"error":"invalid_ssid_mapping"}');
		exit(0);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.