From: Lennart Poettering <lennart@amutable.com>
Date: Fri, 10 Jul 2026 12:34:59 +0000 (+0200)
Subject: sysupdate: generalize feature name validity check
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d298f9bc8e735ad14eef6c989d50c21a241bbe55;p=thirdparty%2Fsystemd.git

sysupdate: generalize feature name validity check

Let's switch to string_is_safe(), and make this available to the rest of
the sysupdate sources too.

This both relaxes and tighten the rules slightly. i.e. control character
and stuff are no longer allowed, but valid UTF-8 (as opposed to ASCII)
now is.
---

diff --git a/src/sysupdate/meson.build b/src/sysupdate/meson.build
index 664f439f797..c4f569096f9 100644
--- a/src/sysupdate/meson.build
+++ b/src/sysupdate/meson.build
@@ -39,7 +39,7 @@ executables += [
                 'name' : 'systemd-sysupdated',
                 'dbus' : true,
                 'conditions' : ['ENABLE_SYSUPDATED'],
-                'sources' : files('sysupdated.c', 'sysupdate-target.c'),
+                'sources' : files('sysupdated.c', 'sysupdate-target.c', 'sysupdate-util.c'),
         },
         executable_template + {
                 'name' : 'updatectl',
diff --git a/src/sysupdate/sysupdate-util.c b/src/sysupdate/sysupdate-util.c
index 8b0a4924e4c..579c1071549 100644
--- a/src/sysupdate/sysupdate-util.c
+++ b/src/sysupdate/sysupdate-util.c
@@ -31,6 +31,17 @@ int reboot_now(void) {
         return 0;
 }
 
+bool feature_name_valid(const char *c) {
+
+        if (!string_is_safe(c, STRING_FILENAME_PART))
+                return false;
+
+        /* Stack allocation is safe, since STRING_FILENAME_PART includes a length check */
+        const char *j = strjoina(c, ".feature.d");
+
+        return filename_is_valid(j);
+}
+
 bool component_name_valid(const char *c) {
         /* See if the specified string enclosed in the directory prefix+suffix would be a valid file name */
 
diff --git a/src/sysupdate/sysupdate-util.h b/src/sysupdate/sysupdate-util.h
index 07d9def7087..6d5230f1e33 100644
--- a/src/sysupdate/sysupdate-util.h
+++ b/src/sysupdate/sysupdate-util.h
@@ -8,5 +8,7 @@ int reboot_now(void);
 #define SD_SYSUPDATE_OFFLINE   (UINT64_C(1) << 0)
 #define SD_SYSUPDATE_FLAGS_ALL (SD_SYSUPDATE_OFFLINE)
 
+bool feature_name_valid(const char *c);
+
 bool component_name_valid(const char *c);
 int get_component_list(const char *root, char ***ret);
diff --git a/src/sysupdate/sysupdated.c b/src/sysupdate/sysupdated.c
index 8022fde77eb..bc5a2439b5a 100644
--- a/src/sysupdate/sysupdated.c
+++ b/src/sysupdate/sysupdated.c
@@ -32,7 +32,6 @@
 #include "notify-recv.h"
 #include "os-util.h"
 #include "parse-util.h"
-#include "path-util.h"
 #include "pidref.h"
 #include "process-util.h"
 #include "runtime-scope.h"
@@ -42,7 +41,6 @@
 #include "strv.h"
 #include "sysupdate-target.h"
 #include "sysupdate-util.h"
-#include "utf8.h"
 
 #define FEATURES_DROPIN_NAME "systemd-sysupdate-enabled"
 
@@ -1404,19 +1402,6 @@ static int target_method_list_features(sd_bus_message *msg, void *userdata, sd_b
         return sd_bus_message_send(reply);
 }
 
-static bool feature_name_is_valid(const char *name) {
-        if (isempty(name))
-                return false;
-
-        if (!ascii_is_valid(name))
-                return false;
-
-        if (!filename_is_valid(strjoina(name, ".feature.d")))
-                return false;
-
-        return true;
-}
-
 static int target_method_describe_feature(sd_bus_message *msg, void *userdata, sd_bus_error *error) {
         Target *t = ASSERT_PTR(userdata);
         _cleanup_(job_freep) Job *j = NULL;
@@ -1430,7 +1415,7 @@ static int target_method_describe_feature(sd_bus_message *msg, void *userdata, s
         if (r < 0)
                 return r;
 
-        if (!feature_name_is_valid(feature))
+        if (!feature_name_valid(feature))
                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid feature name");
 
         if (flags != 0)
@@ -1470,7 +1455,7 @@ static int target_method_set_feature_enabled(sd_bus_message *msg, void *userdata
         r = sd_bus_message_read(msg, "sit", &feature, &enabled, &flags);
         if (r < 0)
                 return r;
-        if (!feature_name_is_valid(feature))
+        if (!feature_name_valid(feature))
                 return sd_bus_reply_method_errorf(msg,
                                                   SD_BUS_ERROR_INVALID_ARGS,
                                                   "The specified feature is invalid");