Files
Mark Johnston 9cb0be8381 bsdconfig: Make sure that SSID names are properly escaped
The f_menu_wpa_scan_results() function returns a list of networks
discovered by a scan.  The untrusted network names are evaluated in
f_dialog_menu_wireless_edit.  The quoting applied in
f_menu_wpa_scan_results() protects against evaluation of something like
"$(whoami)" but one can add single quotes to defeat that.

Pass the SSID names through f_shell_escape to work around this.  Escape
single quotes in f_dialog_wireless_edit() and f_menu_wireless_configs()
too for consistency.

I note that this module doesn't seem to actually work, see e.g.,
bugzilla PR 229883.

Approved by:	so
Security:	FreeBSD-SA-26:23.bsdinstall
Security:	CVE-2026-45255
Reported by:	Austin Ralls
Reviewed by:	dteske, des
Differential Revision:	https://reviews.freebsd.org/D56974
2026-05-20 02:12:20 +00:00
..
2024-02-25 10:03:17 -08:00
2025-02-26 20:14:37 -05:00
2023-08-17 15:08:30 +02:00
2024-10-31 12:40:16 +08:00
2023-08-16 11:55:20 -06:00
2024-04-01 19:49:26 -04:00
2024-11-25 16:33:46 -05:00
2024-11-04 12:16:22 -04:00
2024-10-11 16:10:22 -06:00
2025-02-19 21:34:42 -05:00
2024-12-27 10:40:05 -05:00
2025-04-06 18:04:12 +00:00
2024-12-27 10:40:05 -05:00
2024-01-31 09:16:23 -05:00
2024-08-01 10:55:29 -04:00
2025-05-29 12:58:46 -07:00
2023-08-16 11:55:03 -06:00
2024-12-04 00:55:31 +00:00
2024-11-12 08:40:05 -05:00
2024-05-14 08:58:40 +02:00
2024-10-07 15:32:06 -03:00
2024-08-10 12:21:51 +02:00
2023-10-24 11:22:23 -07:00
2023-08-16 11:55:03 -06:00
2023-08-16 11:55:03 -06:00