RDKB-66533 : Harden $_GET['mac_ssid'] handling with shared validation helper

[pavankumar464]

Reason for change: Fix $_GET['mac_ssid'] handling
Test Procedure: Test for Wi-Fi MAC Filter Setting
Risks: Low
Priority: P1

[Copilot]

Pull request overview

This PR hardens the handling of the mac_ssid query parameter on the wireless network configuration pages by replacing direct $_GET['mac_ssid'] usage with a shared allowlist-based validator, reducing risk of unexpected input influencing UI state.

Changes:

• Removed the old $_GET['mac_ssid'] > 18 early-termination guard from wireless configuration pages.
• Added a shared helper getValidatedAllowedNumericQueryValue() to validate numeric query params against an allowlist derived from available SSIDs.
• Updated the client-side initialization to consume JSON-encoded, validated values (instead of interpolating raw $_GET into JavaScript).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
source/Styles/xb6/jst/wireless_network_configuration.jst	Uses shared helper to validate mac_ssid and safely emits validated values into JS.
source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst	Same hardened mac_ssid handling for the OneWiFi variant.
source/Styles/xb3/jst/wireless_network_configuration.jst	Same hardened mac_ssid handling for xb3 pages.
source/Styles/xb3/jst/includes/utility.jst	Introduces shared allowlist-based numeric query validator used by the updated pages.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (4)

source/Styles/xb6/jst/wireless_network_configuration.jst:466

• is_numeric() accepts formats like scientific notation (e.g., 1e2) and whitespace, which can coerce to unexpected integers via intval(). Also, the new validation only checks a hard-coded range and no longer ensures the requested SSID is actually present in the computed $ssids list for this device/mode, so the UI may attempt to preselect a non-existent option.

Consider validating that the param is a decimal integer string and that it exists in $ssids before passing it to JS.

$mac_ssid_v = "";
	if(isset($_GET['mac_ssid']) && is_numeric($_GET['mac_ssid'])) {
		$mac_ssid_v = intval($_GET['mac_ssid']);
		if ($mac_ssid_v < 1 || $mac_ssid_v > 17)
			$mac_ssid_v = "";

source/Styles/xb6/jst/wireless_network_configuration.jst:457

• The PR title/description mentions using a "shared validation helper", but this validation logic is duplicated across multiple wireless_network_configuration*.jst files. If the intent is a shared helper, consider centralizing this in a shared include (e.g., includes/utility.jst) to reduce drift and ensure fixes land consistently across platforms.

$mac_ssid_v = "";

source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst:474

• is_numeric() accepts formats like scientific notation (e.g., 1e2) and whitespace, which can coerce to unexpected integers via intval(). Also, the new validation only checks a hard-coded range and no longer ensures the requested SSID is actually present in the computed $ssids list for this device/mode, so the UI may attempt to preselect a non-existent option.

Consider validating that the param is a decimal integer string and that it exists in $ssids before passing it to JS.

$mac_ssid_v = "";
	if(isset($_GET['mac_ssid']) && is_numeric($_GET['mac_ssid'])) {
		$mac_ssid_v = intval($_GET['mac_ssid']);
		if ($mac_ssid_v < 1 || $mac_ssid_v > 17)
			$mac_ssid_v = "";

source/Styles/xb3/jst/wireless_network_configuration.jst:353

• is_numeric() accepts formats like scientific notation (e.g., 1e2) and whitespace, which can coerce to unexpected integers via intval(). Also, the new validation only checks a hard-coded range and no longer ensures the requested SSID is actually present in the computed $ssids list for this device/mode, so the UI may attempt to preselect a non-existent option.

Consider validating that the param is a decimal integer string and that it exists in $ssids before passing it to JS.

$mac_ssid_v = "";
if(isset($_GET['mac_ssid']) && is_numeric($_GET['mac_ssid'])) {
	$mac_ssid_v = intval($_GET['mac_ssid']);
	if ($mac_ssid_v < 1 || $mac_ssid_v > 17)
		$mac_ssid_v = "";

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (4)

source/Styles/xb6/jst/wireless_network_configuration.jst:1121

• The mac_ssid value is now validated for type/range, but it can still refer to an SSID that isn’t present in the current <select> options (e.g., restricted ssids list for non-MSO / bridge mode). Setting .val() to a non-existent option can leave the selector in an unexpected state. Consider only applying the value when the option exists in #mac_ssid.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}

source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst:1140

• The mac_ssid value is now validated for type/range, but it can still refer to an SSID that isn’t present in the current <select> options (e.g., restricted ssids list for non-MSO / bridge mode). Setting .val() to a non-existent option can leave the selector in an unexpected state. Consider only applying the value when the option exists in #mac_ssid.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}

source/Styles/xb3/jst/includes/utility.jst:1162

• is_numeric() will accept floats/scientific notation (e.g., 1e2, 1.5) and then intval() coerces them, which can lead to surprising/ambiguous behavior for a parameter that is intended to be an integer SSID id. Consider enforcing a digits-only string before converting to an integer.

	if(isset($_GET['mac_ssid']) && is_numeric($_GET['mac_ssid'])) {
		$mac_ssid_v = intval($_GET['mac_ssid']);
		if ($mac_ssid_v < 1 || $mac_ssid_v > 17)
			$mac_ssid_v = "";
		else

source/Styles/xb3/jst/wireless_network_configuration.jst:861

• The mac_ssid value is now validated for type/range, but it can still refer to an SSID that isn’t present in the current <select> options (e.g., restricted ssids list for non-MSO / bridge mode). Setting .val() to a non-existent option can leave the selector in an unexpected state. Consider only applying the value when the option exists in #mac_ssid.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Previously missed (3) — in code that hasn't changed since the last review.

source/Styles/xb6/jst/wireless_network_configuration.jst:1122

• The GET-derived mac_ssid_GET is now only range-validated, but it is no longer checked against the page’s allowed $ssids list (which can be limited to 1,2 / 1,2,17 depending on login user, bridge mode, etc.). This can cause the UI to attempt selecting an SSID that is not present in the dropdown and then call update_Wi_Fi_control_list() with an invalid/empty selection.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}
	update_Wi_Fi_control_list();

source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst:1141

• The GET-derived mac_ssid_GET is no longer checked against the allowed $ssids list before being applied to #mac_ssid. Since $ssids can exclude some SSIDs based on mode/platform/user, this can result in selecting a non-existent SSID option and calling update_Wi_Fi_control_list() with an invalid selection.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}
	update_Wi_Fi_control_list();

source/Styles/xb3/jst/wireless_network_configuration.jst:862

• mac_ssid_GET is range-validated, but it is no longer checked against the page’s allowed $ssids list (which is 1,2 for non-MSO users and may exclude more values in bridge mode). This can cause the page to try to select an SSID that isn’t available in the dropdown and then refresh the MAC filter table for an invalid SSID.

	var mac_ssid_GET = <?% echo($mac_ssid_v_js);?>;
	if (mac_ssid_GET !== "") {
		$("#mac_ssid").val(mac_ssid_GET);
	}
	update_Wi_Fi_control_list();