Skip to content

Reject unknown preset text that injects PPD lines (OCU-01-008) #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Dhirenderchoudhary wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Reject unknown preset text that injects PPD lines (OCU-01-008) #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
391e008
Test that a preset newline cannot start a PPD directive.
Dhirenderchoudhary Nov 8, 2026
30448f8
ppd-generator.c: Copy only scalar preset members into the PPD.
Dhirenderchoudhary Nov 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions ppd/ppd-generator.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2847,12 +2847,15 @@ ppdCreatePPDFromIPP2(char *buffer, // I - Filename buffer
else if (keyword && !strcmp(keyword, "two-sided-short-edge"))
cupsFilePuts(fp, "*Duplex DuplexTumble\n");
}
else
else if ((ippGetValueTag(member) == IPP_TAG_BOOLEAN ||
ippGetValueTag(member) == IPP_TAG_INTEGER ||
ippGetValueTag(member) == IPP_TAG_KEYWORD) &&
ippValidateAttribute(member))
{
//
// Add attribute name and value as-is...
//

// Text and name values may contain newlines. A newline here
// starts a new PPD statement. Boolean, integer, and keyword
// values are single tokens, and ippValidateAttribute rejects
// a member name that is not a keyword.
ippAttributeString(member, member_value, sizeof(member_value));
cupsFilePrintf(fp, "*%s %s\n", member_name, member_value);
}
Expand Down
36 changes: 36 additions & 0 deletions ppd/test_ppd_generator.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1159,6 +1159,42 @@ main(void)
"status=\"%s\"", status_msg);
ippDelete(resp);

// T46 — Unknown job-presets-supported text is copied with
// ippAttributeString, which keeps embedded newlines. A newline
// starts a new PPD statement. A known member (sides) and a
// keyword member (print-color-mode) must still be written.
testBegin("preset text newline is not a new PPD directive");
resp = make_pdf_ipp();
{
ipp_t *preset = ippNew();

ippAddString(preset, IPP_TAG_ZERO, IPP_TAG_NAME, "preset-name",
NULL, "Office");
ippAddString(preset, IPP_TAG_ZERO, IPP_TAG_KEYWORD, "sides",
NULL, "one-sided");
ippAddString(preset, IPP_TAG_ZERO, IPP_TAG_KEYWORD, "print-color-mode",
NULL, "monochrome");
ippAddString(preset, IPP_TAG_ZERO, IPP_TAG_TEXT, "evil-option", NULL,
"ok\n*INJECTED-DIRECTIVE evil");
ippAddCollection(resp, IPP_TAG_PRINTER, "job-presets-supported", preset);
ippDelete(preset);
}
result = ppdCreatePPDFromIPP2(buffer, sizeof(buffer), resp,
"Test", "application/pdf",
0, 0, NULL, NULL, NULL, NULL, NULL, 0);
ppd_text = result ? slurp_file(buffer) : NULL;
testEndMessage(ppd_text &&
strstr(ppd_text, "*Duplex None\n") &&
strstr(ppd_text, "*print-color-mode monochrome\n") &&
strstr(ppd_text, "INJECTED-DIRECTIVE") == NULL,
"duplex=%d color=%d injected=%d",
ppd_text && strstr(ppd_text, "*Duplex None\n") != NULL,
ppd_text && strstr(ppd_text, "*print-color-mode monochrome\n") != NULL,
ppd_text && strstr(ppd_text, "INJECTED-DIRECTIVE") != NULL);
if (result == buffer) unlink(buffer);
free(ppd_text);
ippDelete(resp);


return (testsPassed ? 0 : 1);
}
Loading