fix(bootloader-env): block all fw_setenv options, not only -s/--script

recipes-omnect/bootloader_env/bootloader-env/bootloader_env_grub.sh

@@ -1,46 +1,43 @@
 #!/bin/bash -e
 set -o pipefail
 grubenv="/boot/EFI/BOOT/grubenv"
-commands=("get" "list" "set" "unset")
-argsc=${#}
 
 function help() {
     echo "usage:"
     echo "bootloader_env.sh command key [value]"
     echo "    command: {get,list,set,unset}"
 }
 
-function get() {
-    [[ ${argsc} -ne 2 ]] && help && exit 1
-    local key=${1}
-    local value=$(grub-editenv ${grubenv} list | grep ^${key}=)
-    value=${value#${key}=}
+function cmd_get() {
+    [[ ${#} -ne 1 ]] && help && exit 1
+    local key="${1}"
+    local value=$(grub-editenv "${grubenv}" list | grep "^${key}=")
+    value="${value#"${key}"=}"
     [[ -z "${value}" ]] && echo && exit 2
-    echo ${value}
+    printf '%s\n' "${value}"
 }
 
-function list(){
-    [[ ${argsc} -ne 1 ]] && help && exit 1
-    grub-editenv ${grubenv} list
+function cmd_list() {
+    [[ ${#} -ne 0 ]] && help && exit 1
+    grub-editenv "${grubenv}" list
 }
 
-function set () {
-    [[ ${argsc} -ne 3 ]] && help && exit 1
-    local key=${1}
-    local value=${@:2}
-    grub-editenv ${grubenv} set "${key}"="${value}"
+function cmd_set() {
+    [[ ${#} -ne 2 ]] && help && exit 1
+    local key="${1}"
+    local value="${2}"
+    grub-editenv "${grubenv}" set "${key}"="${value}"
     sync
 }
 
-function unset() {
-    [[ ${argsc} -ne 2 ]] && help && exit 1
-    local key=${1}
-    grub-editenv ${grubenv} unset "${key}"
+function cmd_unset() {
+    [[ ${#} -ne 1 ]] && help && exit 1
+    local key="${1}"
+    grub-editenv "${grubenv}" unset "${key}"
     sync
 }
 
 [[ ${#} -lt 1 ]] && help && exit 1
-[[ ! " ${commands[@]} " =~ " ${1} " ]] && help && exit 1
+declare -F "cmd_${1}" > /dev/null || { help; exit 1; }
 
-#exec
-${1} ${@:2}
+"cmd_${1}" "${@:2}"

recipes-omnect/bootloader_env/bootloader-env/bootloader_env_u-boot.sh

@@ -1,49 +1,44 @@
 #!/bin/bash
-commands=("get" "list" "set" "unset")
-argsc=${#}
 
 function help() {
     echo "usage:"
     echo "bootloader_env.sh command key [value]"
     echo "    command: {get,list,set,unset}"
 }
 
-function get() {
-    [[ ${argsc} -ne 2 ]] && help && exit 1
-    local key=${1}
-    local value=$(fw_printenv ${key})
-    value=${value#${key}=}
+function cmd_get() {
+    [[ ${#} -ne 1 ]] && help && exit 1
+    local key="${1}"
+    local value=$(fw_printenv -- "${key}")
+    value="${value#"${key}"=}"
     [[ -z "${value}" ]] && echo && exit 2
-    echo ${value}
+    printf '%s\n' "${value}"
 }
 
-function list(){
-    [[ ${argsc} -ne 1 ]] && help && exit 1
+function cmd_list() {
+    [[ ${#} -ne 0 ]] && help && exit 1
     fw_printenv
 }
 
-function set () {
-    [[ ${argsc} -ne 3 ]] && help && exit 1
-    local key=${1}
-    local value=${@:2}
+function cmd_set() {
+    [[ ${#} -ne 2 ]] && help && exit 1
+    local key="${1}"
+    local value="${2}"
 
-    for word in $key $value; do
-        if [[ "$word" == "-s" || "$word" == "--script" || "$word" == -s=* || "$word" == --script=* ]]; then
-            echo "Script-file mode is not allowed (flag: $word)"; exit 66;
-        fi
-    done
-
-    fw_setenv "${key}" "${value}"
+    # '--' ends option parsing, so key and value are always treated as data.
+    # this blocks script mode and every other option, e.g. an attacker-chosen
+    # config file, which a flag blocklist would miss (getopt accepts attached
+    # values like -sFILE and abbreviations like --scr=FILE)
+    fw_setenv -- "${key}" "${value}"
 }
 
-function unset() {
-    [[ ${argsc} -ne 2 ]] && help && exit 1
-    local key=${1}
-    fw_setenv "${key}"
+function cmd_unset() {
+    [[ ${#} -ne 1 ]] && help && exit 1
+    local key="${1}"
+    fw_setenv -- "${key}"
 }
 
 [[ ${#} -lt 1 ]] && help && exit 1
-[[ ! " ${commands[@]} " =~ " ${1} " ]] && help && exit 1
+declare -F "cmd_${1}" > /dev/null || { help; exit 1; }
 
-#exec
-${1} ${@:2}
+"cmd_${1}" "${@:2}"

recipes-omnect/omnect-device-service/omnect-device-service_0.45.0.bb → recipes-omnect/omnect-device-service/omnect-device-service_0.45.1.bb

@@ -6,9 +6,9 @@ inherit cargo
 # DEFAULT_PREFERENCE = "-1"
 
 # how to get omnect-device-service could be as easy as but default to a git checkout:
-# SRC_URI += "crate://crates.io/omnect-device-service/0.45.0"
+# SRC_URI += "crate://crates.io/omnect-device-service/0.45.1"
 SRC_URI += "git://github.com/omnect/omnect-device-service.git;protocol=https;nobranch=1;branch=main"
-SRCREV = "a34303a576874c8b6716d90c403595a2f4892305"
+SRCREV = "f5a2c5671d500e2187b651fb51afcc8d0b2d06a4"
 S = "${WORKDIR}/git"
 CARGO_SRC_DIR = ""