RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI BPI

[vanemage]

No description provided.

[github-actions]

📋 PR Format Reminder

• Title: RDKBACCL-1962 RDKB- Security Vulnerability Findings Report in WebUI BPI — expected TICKET-123 : description
  (Multiple tickets OK: RDKCOM-5492 RDKBDEV-3336 : ... | Include US ticket + subtask for user-stories)
• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

This PR hardens the XB6 WebUI “onewifi” wireless configuration action handler by adding stricter validation and mapping for ssid_number, intended to address security vulnerability findings around untrusted input affecting TR-181 paths and radio selection.

Changes:

• Adds SSID instance bounds ($MIN_SSID_INSTANCE, $MAX_SSID_INSTANCES) and validates ssid_number length/format/range with 400 responses on invalid input.
• Introduces ResolveRadioFromSsid() to constrain which SSID instances are allowed to map to radios.
• Refactors the non-band_steering path to derive $r via the mapping helper and adds a small apply helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst:144

• The if ($i == 17) ... else ... block lacks braces, so only the $i = String(...) line is actually under else and $r = ResolveRadioFromSsid($i) runs unconditionally. This also re-reads $arConfig['ssid_number'], bypassing the earlier validated $i value and makes the special-case for SSID 17 ineffective.

	$i = $arConfig['ssid_number'];
        if($i == 17)
		$r=3;   //17th is private ssid for 6 GHz(radio 3)
	else
            $i = String($arConfig['ssid_number']);
        $r = ResolveRadioFromSsid($i);

source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst:153

• $channel is referenced later (e.g., when deciding whether to append to Consolelog), but after this change it is never assigned. This will result in an undefined-variable notice/error and the comparison may behave incorrectly. Define $channel here (or update the later reference to use the new variable name).

        $get_channel_automatic  = getStr("Device.WiFi.Radio."+$r+".AutoChannelEnable");
        $get_wireless_mode      = getStr("Device.WiFi.Radio."+$r+".OperatingStandards");
        $get_channel_bandwidth  = getStr("Device.WiFi.Radio."+$r+".OperatingChannelBandwidth");

source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst:83

• $ssid_number is optional here, but the rest of this handler later assumes it exists (e.g., $arConfig['ssid_number']), which can lead to undefined-index/type errors and makes the validation bypassable. Treat a missing ssid_number as an invalid request and return 400 early.

This issue also appears on line 139 of the same file.

$i = (array_key_exists('ssid_number', $arConfig)) ? String($arConfig['ssid_number']) : "";
$ssid_log = substr(String($i), 0, 32);
if ($i != "" && strlen($i) > 3) {