fix(udm): sanitize SDM processor errors - #94
Merged
Conversation
Six GET handlers forwarded the supi path parameter to UDR without calling validator.IsValidSupi(), unlike HandleGetAmData in the same file. A crafted supi containing control characters makes UDM build an invalid internal UDR URL, fail net/url parsing, and return a 500 that leaks the full internal UDR URL in the response body (CVE-2026-42459, missed fix of CVE-2026-27642). Apply the same validation block used by HandleGetAmData to HandleGetSmfSelectData, HandleGetSupi, HandleGetTraceData, HandleGetUeContextInSmfData, HandleGetNssai and HandleGetSmData. Fixes #1122
The SUPI validation added in this PR rejects non-IMSI values, so the plmn-id conformance test must use a well-formed SUPI to reach the query-param check. Also switch httptest.NewRequest to NewRequestWithContext to satisfy noctx.
wiwi878
force-pushed
the
fix/1122-supi-validation
branch
from
August 20, 2026 06:33
183e244 to
b98ead2
Compare
wiwi878
changed the title
Alonza0314
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #91
Summary
ProblemDetails.detail.Relationship to #91
PR #91 adds the SUPI validation in the six Nudm_SDM GET handlers. This PR is a follow-up defense-in-depth change at the processor error boundary and intentionally does not duplicate the handler validation or API tests from #91.
Related issue: free5gc/free5gc#1122
Validation