Added network interface names escaping.
Ylian Saint-Hilaire committed
Dec 28, 2020 at 23:14 UTC
8fc23995b98521adbdaa283d606a5472da23314d
3 files changed
+26
-3
meshagent.js
+8
@@ -1164,6 +1164,14 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1164
// Check if network information is present
1165
if ((command.netif2 == null) && (command.netif == null)) return;
1166
1167
+ // Escape any field names that have special characters
1168
+ if (command.netif2 != null) {
1169
+ for (var i in command.netif2) {
1170
+ var esc = common.escapeFieldName(i);
1171
+ if (esc !== i) { command.netif2[esc] = command.netif2[i]; delete command.netif2[i]; }
1172
+ }
1173
+ }
1174
+
1175
// Sent by the agent to update agent network interface information
1176
delete command.action;
1177
command.updateTime = Date.now();
meshcentral.js
+9
-3
@@ -733,9 +733,9 @@ function CreateMeshCentralServer(config, args) {
733
if (obj.args.createaccount.startsWith('user/')) { userid = obj.args.createaccount; domainid = obj.args.createaccount.split('/')[1]; }
734
if (userid.split('/').length != 3) { console.log("Invalid userid."); process.exit(); return; }
735
obj.db.Get(userid, function (err, docs) {
736
- if (err != null) { console.log("Database error: " + err); process.exit(); return; }
736
+ if (err != null) { console.log("Database error: " + err); process.exit(); return; }
737
if ((docs != null) && (docs.length != 0)) { console.log('User already exists.'); process.exit(); return; }
738
- if ((domainid != '') && ((config.domains == null) || (config.domains[domainid] == null))) { console.log("Invalid domain."); process.exit(); return; }
738
+ if ((domainid != '') && ((config.domains == null) || (config.domains[domainid] == null))) { console.log("Invalid domain."); process.exit(); return; }
739
var user = { _id: userid, type: 'user', name: (typeof obj.args.name == 'string') ? obj.args.name : (userid.split('/')[2]), domain: domainid, creation: Math.floor(Date.now() / 1000), links: {} };
740
if (typeof obj.args.email == 'string') { user.email = obj.args.email; user.emailVerified = true; }
741
require('./pass').hash(obj.args.pass, function (err, salt, hash, tag) { if (err) { console.log("Unable create account password: " + err); process.exit(); return; } user.salt = salt; user.hash = hash; obj.db.Set(user, function () { console.log("Done."); process.exit(); return; }); }, 0);
@@ -901,7 +901,13 @@ function CreateMeshCentralServer(config, args) {
901
if (badCharCount > 0) { console.log(badCharCount + ' invalid character(s) where removed.'); }
902
try { json = JSON.parse(json2); } catch (e) { console.log('Invalid JSON format: ' + obj.args.dbimport + ': ' + e); process.exit(); }
903
if ((json == null) || (typeof json.length != 'number') || (json.length < 1)) { console.log('Invalid JSON format: ' + obj.args.dbimport + '.'); }
904
- for (i in json) { if ((json[i].type == "mesh") && (json[i].links != null)) { for (var j in json[i].links) { var esc = obj.common.escapeFieldName(j); if (esc !== j) { json[i].links[esc] = json[i].links[j]; delete json[i].links[j]; } } } } // Escape MongoDB invalid field chars
904
+ // Escape MongoDB invalid field chars
905
+ for (i in json) {
906
+ var doc = json[i];
907
+ for (var j in doc) { if (j.indexOf('.') >= 0) { console.log("Invalid field name (" + j + ") in document: " + json[i]); return; } }
908
+ if ((json[i].type == "ifinfo") && (json[i].netif2 != null)) { for (var j in json[i].netif2) { var esc = obj.common.escapeFieldName(j); if (esc !== j) { json[i].netif2[esc] = json[i].netif2[j]; delete json[i].netif2[j]; } } }
909
+ if ((json[i].type == "mesh") && (json[i].links != null)) { for (var j in json[i].links) { var esc = obj.common.escapeFieldName(j); if (esc !== j) { json[i].links[esc] = json[i].links[j]; delete json[i].links[j]; } } }
910
+ }
911
//for (i in json) { if ((json[i].type == "node") && (json[i].host != null)) { json[i].rname = json[i].host; delete json[i].host; } } // DEBUG: Change host to rname
912
setTimeout(function () { // If the Mongo database is being created for the first time, there is a race condition here. This will get around it.
913
obj.db.RemoveAll(function () {
meshuser.js
+9
@@ -3857,6 +3857,15 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3857
db.Get('if' + node._id, function (err, netinfos) {
3858
if ((netinfos == null) || (netinfos.length != 1)) { try { ws.send(JSON.stringify({ action: 'getnetworkinfo', nodeid: node._id, netif: null, netif2: null })); } catch (ex) { } return; }
3859
var netinfo = netinfos[0];
3860
+
3861
+ // Unescape any field names that have special characters if needed
3862
+ if (netinfo.netif2 != null) {
3863
+ for (var i in netinfo.netif2) {
3864
+ var esc = common.unEscapeFieldName(i);
3865
+ if (esc !== i) { netinfo.netif2[esc] = netinfo.netif2[i]; delete netinfo.netif2[i]; }
3866
+ }
3867
+ }
3868
+
3869
try { ws.send(JSON.stringify({ action: 'getnetworkinfo', nodeid: node._id, updateTime: netinfo.updateTime, netif: netinfo.netif, netif2: netinfo.netif2 })); } catch (ex) { }
3870
});
3871
});