Reject unknown preset text that injects PPD lines (OCU-01-008) - #105

7ASecurity audit of OpenPrinting, finding OCU-01-008, WP1/2, Medium.

CUPS and libppd build a local PPD from the IPP attributes of a remote printer when a driverless queue is created. Known job-presets-supported members are mapped to PPD keywords. Unknown members were written with ippAttributeString() and cupsFilePrintf(fp, "*%s %s\n", member_name, member_value). ippAttributeString() keeps embedded newlines in text and name values, so a preset value can start a new top-level PPD statement such as *cupsFilter2.

A printer on the network can advertise that collection in Get-Printer-Attributes. If someone adds the printer with a driverless path such as lpadmin -m everywhere, the queue PPD can contain those extra statements. Later print jobs then follow the injected PPD, not only the options the printer meant to describe. Remote capability data is supposed to describe device options. It is not supposed to author top-level PPD directives.

Why

The fallback treated an unknown preset member as safe PPD syntax. The fix writes an unknown member only when the value is a boolean, an integer, or a keyword, and ippValidateAttribute() accepts the member. That is the same gate the CUPS generator already uses.

What changed

• Unknown preset members of any other type are skipped. Text and name values no longer become PPD lines.
• test_ppd_generator builds a preset with sides=one-sided, a print-color-mode keyword, and a text value that contains a newline. The generated file must contain *Duplex None and *print-color-mode monochrome, and must not contain the injected directive.

Scope

This pull request covers the libppd generator. A separate pull request covers the CUPS copy. ippAttributeString() is unchanged. foomatic-rip is unchanged.

Tradeoffs

Dropping every unknown member would also drop real keyword options such as print-color-mode. The generator keeps boolean, integer, and keyword members.

Blast Radius

Driverless PPDs no longer copy text or name preset members. Presets that only use boolean, integer, and keyword members still appear.

Verification

• Before the fix, test_ppd_generator printed preset text newline is not a new PPD directive: FAIL (duplex=1 color=1 injected=1) and exited 1.
• After the fix, the same test printed PASS (duplex=1 color=1 injected=0) and exited 0. The rest of test_ppd_generator passed (50 PASS lines, exit 0).
• Built and run on Ubuntu 24.04 against libcups 2.4.7.