Skip to content
This repository was archived by the owner on Dec 12, 2025. It is now read-only.

Conversation

@guruchandru
Copy link

No description provided.

guruchandru and others added 30 commits October 22, 2021 19:27
Get meson to build with the rbus stuff.
Cmake integration and initial code commit
Adding cimplog fix for extender support
Check CR systemready using rbus
Move connected client notification business logic from webconfig to w…
@guardrails
Copy link

guardrails bot commented Dec 22, 2021

⚠️ We detected 13 security issues in this pull request:

Hard-Coded Secrets (5)
Docs Details
💡 Title: Hex High Entropy String, Severity: Medium
GIT_TAG "7a98138f27f27290e680bf8fbf1f8d1b089bf138"
💡 Title: Hex High Entropy String, Severity: Medium
GIT_TAG "aafb64a1c549b7b927e339df6d35b1d5059dc235"
💡 Title: Hex High Entropy String, Severity: Medium
GIT_TAG "796dddbcfa7686ec63536d950775e79b52ee5c3f"
💡 Title: Hex High Entropy String, Severity: Medium
source_hash = fb50a663eefdc76bafa80c82bc045af13b1363e8f45cec8b442007aef6a41343
💡 Title: Hex High Entropy String, Severity: Medium
patch_hash = 82d7a029637bdd6696a89075907581768e7088c20b1c69f400cb6e15e716d803

More info on how to fix Hard-Coded Secrets in General.


Insecure Processing of Data (4)
Docs Details
💡 Title: Insecure use of format strings, Severity: Critical
#define WebConfigLog(...) printf(__VA_ARGS__)
💡 Title: Insecure use of format strings, Severity: Critical
#define WebcfgError(...) printf(__VA_ARGS__)
💡 Title: Insecure use of format strings, Severity: Critical
#define WebcfgInfo(...) printf(__VA_ARGS__)
💡 Title: Insecure use of format strings, Severity: Critical
#define WebcfgDebug(...) printf(__VA_ARGS__)

More info on how to fix Insecure Processing of Data in C/C++.


Insecure Use of Dangerous Function (4)
Docs Details
💡 Title: Use of strcpy, Severity: Critical
strncpy(destStr, srcStr, destSize-1);
💡 Title: Use of strcat, Severity: Critical
strncat(macConverted, token[i], 31);
💡 Title: Use of strcpy, Severity: Critical
strncpy(destStr, srcStr, destSize-1);
💡 Title: Use of strcat, Severity: Critical
strncat(macConverted, token[i], 63);

More info on how to fix Insecure Use of Dangerous Function in C/C++.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

werror = true
endif

script = join_paths(meson.source_root(), 'workaround.sh')
Copy link

@eli-schwartz eli-schwartz Dec 23, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems wrong. meson 0.55.0 added a patch_directory option to handle locally wrapped dependencies, so you do not need to autogenerate tarball intermediaries here.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@eli-schwartz The yocto build we're using (and can't change for a while) is using meson 0.53. We've not been able to iron out a set of LD based issues for the cross compiler calls with meson, which is why CMake got added. I've not been able to get back to trying to find a better solution for this, but good suggestion.

@guruchandru I'd rather not add the workaround code to the meson file since that couples us with a hack that hopefully we can remove sooner than later.

Copy link

@eli-schwartz eli-schwartz Dec 23, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In that case, at least re: my comment below you cannot rely on the [provide] section either, so you can just add the fallback: ['foo_project', 'foo_dep'] styled references to each one, and you still do not need if/else logic. :)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as these wraps go... jansson could probably go into the wrapdb, the other ones look like they may be specialized enough that that is not worth it so the alternative would be somehow getting meson.build files into those repos...

################################################################################

if meson.version().version_compare('>=0.54.0')
libcjson_dep = dependency('libcjson', version: '>=1.7.14', fallback: ['cjson'])

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need this if/else, since most of them are doing the exact same thing.

And use of the [provide] section means that new enough versions of meson automatically fall back with zero configuration, so it's not necessary to add special handling in meson.build.

inc = include_directories(inc_base)
inc = include_directories([inc_base])

src_args = ['-lcjson', '-lpthread']

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The former is already handled by libcjson_dep, the latter should not be handled by manual -l flags, see https://mesonbuild.com/FAQ.html#what-is-the-correct-way-to-use-threads-such-as-pthreads

#include <wdmp-c.h>

#if ! defined(DEVICE_EXTENDER)
#include <cimplog.h>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should only be internal & not part of the exported API.

/*----------------------------------------------------------------------------*/
/* Macros */
/*----------------------------------------------------------------------------*/
#define CPEABS_FREE(__x__) if(__x__ != NULL) { free((void*)(__x__)); __x__ = NULL;} else {printf("Trying to free null pointer\n");}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably not be exported. If the data structures must be freed using a special function, it should be a function and not a macro. Generally macros like this should be made a function.

/* Macros */
/*----------------------------------------------------------------------------*/
#define CPEABS_FREE(__x__) if(__x__ != NULL) { free((void*)(__x__)); __x__ = NULL;} else {printf("Trying to free null pointer\n");}
#define UNUSED(x) (void )(x)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be exported but in an internal only header.

/*----------------------------------------------------------------------------*/
#define CPEABS_FREE(__x__) if(__x__ != NULL) { free((void*)(__x__)); __x__ = NULL;} else {printf("Trying to free null pointer\n");}
#define UNUSED(x) (void )(x)
#define MAX_BUFF_SIZE 256
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be exported from the library. Where ever this is defined, add a comment explaining what the buffer is & any assumptions about how you came up with 256.

/**
* @brief Enables or disables debug logs.
*/
#if defined DEVICE_GATEWAY && defined BUILD_YOCTO
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This block should all be internal facing only.

}
else
{
WebcfgError("Failed to GetValue for PartnerID\n");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this leak the partner_id value?

src/pods/impl.c Outdated
WebcfgError("%s : partner_id couldnt be assigned with memory\n",__func__);
return NULL;
}
ret_val = get_id_pstore(partner_id_chk,partner_id);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of passing in memory, why not have get_id_pstore just malloc() the memory and return it?

}
else
{
WebcfgError("Failed to GetValue for AccountID\n");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could link memory.

return end_time;
}

int Get_Webconfig_URL( char *pString)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be worth looking at normalizing the function names at some point.

WebcfgDebug("Successfully fetched Webconfig URL : [%s]. \n", url);
ret = RETURN_OK;
}
else{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please run the code formatting across the code so this is all normalized. This will reduce maintenance efforts in the future.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I realized I don't have the code format checking code in across the board. I'm working on this & we can do it after this PR.

/* External Functions */
/*----------------------------------------------------------------------------*/

char * getParamValue(char *paramName);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add the descriptive header for getParamValue() to the header file so that users of the header file can see it easily and without needing to dig into the c source code. Same for the functions below.

@@ -0,0 +1,48 @@
/* SPDX-FileCopyrightText: 2021 Comcast Cable Communications Management, LLC */
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cpeabs.h file should really hide this detail from being exported. These functions should be normalized and added there vs. having a cpeabs_rdkb.h and a cpeabs_pod.h and other files that are used by other libraries. This can live in the src directory if it is only needed internally.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants