Redis schema updates and fix for GitHub issue #72

netconf-service/redis-schema.md

@@ -38,6 +38,7 @@ Note: users are referred to elsewhere in the database by their compound key \<au
 - R lastLogin :: timestamp of last login
 - R creationTime: :: timestamp of account creation
 - M displayName :: usually First Last, defaults to e-mail address for 'local' auth and whatever the OpenID API says for third party auth such as Google.
+- M defaultCard :: ID of default credit card (actual card objects are stored by Stripe, not in this database)
 - R stripeCustomerId :: customer ID for Stripe credit card service if the user has cards on file (we don't store cards, we let Stripe do that)
 
 ## Networks
@@ -63,6 +64,7 @@ Each network has a network record indexed by its 64-bit network ID in lower-case
 - M v4AssignPool :: network/bits from which to assign IPs
 - M v6AssignMode :: 'none' (or null/empty/etc.), 'zt', 'v6native', 'dhcp6'
 - M v6AssignPool :: network/bits from which to assign IPs
+- M subscriptions :: comma-delimited list of subscriptions for this network
 - M ui :: string-serialized JSON blob for use by the user interface, ignored by netconf-master
 
 ### zt1:network:\<nwid\>:member:\<address\>:~

node/SoftwareUpdater.cpp

@@ -201,7 +201,17 @@ void SoftwareUpdater::_cbHandleGetLatestVersionBinary(void *arg,int code,const s
 		return;
 	}
 	std::string updatesDir(_r->homePath + ZT_PATH_SEPARATOR_S + "updates.d");
-	std::string updatePath(updatesDir + ZT_PATH_SEPARATOR_S + url.substr(lastSlash + 1));
+	std::string updateFilename(url.substr(lastSlash + 1));
+	for(std::string::iterator c(updateFilename.begin());c!=updateFilename.end();++c) {
+		// Only allow a list of whitelisted characters to make up the filename to prevent any
+		// path shenanigans, esp on Windows where / is not the path separator.
+		if (!strchr("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.0123456789",*c)) {
+			LOG("software update failed: invalid URL: filename contains invalid characters");
+			upd->_status = UPDATE_STATUS_IDLE;
+			return;
+		}
+	}
+	std::string updatePath(updatesDir + ZT_PATH_SEPARATOR_S + updateFilename);
 #ifdef __WINDOWS__
 	CreateDirectoryA(updatesDir.c_str(),NULL);
 #else