dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bugfix/validate-user-provided-file-object-paths (#1197)

Browse Source 
* Fixed BACnet file object path name unintended path traversals by optionally restricting path name content with BACNET_FILE_PATH_RESTRICTED define.

* Added POSIX file path name checking for AtomicReadFile and AtomicWriteFile example applications. Prohibits use of relative and absolute file paths when BACNET_FILE_PATH_RESTRICTED is non-zero.
This commit is contained in:
Steve Karg
2026-01-05 11:19:52 -06:00
committed by GitHub
parent 715e45eb5c
commit c5dc00a77b
11 changed files with 151 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+7 -1
View File
@@ -12,7 +12,7 @@ The git repositories are hosted at the following sites:
* https://bacnet.sourceforge.net/
* https://github.com/bacnet-stack/bacnet-stack/
## [Unreleased] - 2026-01-03
## [Unreleased] - 2026-01-05
### Security
@@ -26,9 +26,15 @@ The git repositories are hosted at the following sites:
Fixed ubasic string variables to initialize with zeros.
Fixed compile errors when UBASIC_DEBUG_STRINGVARIABLES is defined.
Added ubasic string variables user accessor API and unit testing. (#1196)
* Secured BACnet file object pathname received from BACnet AtomicWriteFile
or ReadFile service used without validation which was vulnerable to
directory traversal attacks. (#1197)
### Added
* Added file path name checking for AtomicReadFile and AtomicWriteFile
example applications. Prohibits use of relative and absolute file paths
when BACNET_FILE_PATH_RESTRICTED is defined non-zero. (#1197)
* Added API and optional properties to basic load control object example
Refactored BACnetShedLevel encoding, decoding, and printing into separate
file. Added BACnetShedLevel validation testing. (#1187)