Bugfix/validate-user-provided-file-object-paths (#1197)

* Fixed BACnet file object path name unintended path traversals by optionally restricting path name content with BACNET_FILE_PATH_RESTRICTED define. * Added POSIX file path name checking for AtomicReadFile and AtomicWriteFile example applications. Prohibits use of relative and absolute file paths when BACNET_FILE_PATH_RESTRICTED is non-zero.
2026-01-05 11:19:52 -06:00
parent 715e45eb5c
commit c5dc00a77b
11 changed files with 151 additions and 16 deletions
@@ -159,6 +159,10 @@ int main(int argc, char *argv[])
    /* decode the command line parameters */
    Target_Device_Object_Instance = strtol(argv[1], NULL, 0);
    Target_File_Object_Instance = strtol(argv[2], NULL, 0);
+    if (!filename_path_valid(argv[3])) {
+        fprintf(stderr, "Invalid file path: %s\n", argv[3]);
+        return 1;
+    }
    Local_File_Name = argv[3];
    if (Target_Device_Object_Instance > BACNET_MAX_INSTANCE) {
        fprintf(