mrquincle/bluenet

No protection against invalid switch command values from microapp

mrquincle opened this issue · 0 comments

There's no proper detection against microapp enum mistakes.

cs_ret_code_t MicroappRequestHandler::handleRequestSwitch(microapp_sdk_switch_t* switchRequest) {
	MicroappSdkSwitchValue value = (MicroappSdkSwitchValue)switchRequest->value;
	LogMicroappRequestHandlerDebug("handleMicroappSwitchRequest: [value %i]", value);
	TYPIFY(CMD_SWITCH) switchCommand;
	switchCommand.switchCmd = value;
	cmd_source_with_counter_t source(CS_CMD_SOURCE_MICROAPP);
	event_t event(CS_TYPE::CMD_SWITCH, &switchCommand, sizeof(switchCommand), source);
	event.dispatch();
	switchRequest->header.ack = CS_MICROAPP_SDK_ACK_SUCCESS;
	return ERR_SUCCESS;
}

The switchCmd field is set without value being checked against the MicroappSdkSwitchValue enum in source/shared/cs_MicroappStructs.h.