Skip to content

RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI BPI - #148

Open
vanemage wants to merge 1 commit into
rdkcentral:developfrom
vanemage:feature/RDKBACCL-1962-WebUI-SSID-Security
Open

RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI BPI#148
vanemage wants to merge 1 commit into
rdkcentral:developfrom
vanemage:feature/RDKBACCL-1962-WebUI-SSID-Security

Conversation

@vanemage

@vanemage vanemage commented Aug 3, 2026

Copy link
Copy Markdown

No description provided.

Copilot AI review requested due to automatic review settings August 3, 2026 03:28
@vanemage
vanemage requested review from a team as code owners August 3, 2026 03:28
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

📋 PR Format Reminder

  • Title: RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI BPI — expected TICKET-123 : description
    (Multiple tickets OK: RDKCOM-5492 RDKBDEV-3336 : ... | Include US ticket + subtask for user-stories)
  • Description missing:
    • Reason for change
    • Test Procedure
    • Risks (Low / Medium / High)
    • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the XB6 WebUI “onewifi” wireless configuration action handler by adding stricter validation and mapping for ssid_number, intended to address security vulnerability findings around untrusted input affecting TR-181 paths and radio selection.

Changes:

  • Adds SSID instance bounds ($MIN_SSID_INSTANCE, $MAX_SSID_INSTANCES) and validates ssid_number length/format/range with 400 responses on invalid input.
  • Introduces ResolveRadioFromSsid() to constrain which SSID instances are allowed to map to radios.
  • Refactors the non-band_steering path to derive $r via the mapping helper and adds a small apply helper.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +161 to +163
$get_channel_automatic = getStr("Device.WiFi.Radio."+$r+".AutoChannelEnable");
$get_wireless_mode = getStr("Device.WiFi.Radio."+$r+".OperatingStandards");
$get_channel_bandwidth = getStr("Device.WiFi.Radio."+$r+".OperatingChannelBandwidth");
Comment on lines +153 to +154
$i = String($arConfig['ssid_number']);
$r = ResolveRadioFromSsid($i);
Comment on lines +108 to 109

if($i == "17")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants