Validate user name for CIFS

Providing comma (,) in username can lead to inject some unappropriate
mount options. In opposite to password, username is not escaped by
kernel driver so we have to disallow such entries.

Tested:
Manually mounting CIFS share with comma

Change-Id: I20ff5089d04f07d7e6aa3190fe83babdd7acfe96
Signed-off-by: Czarnowski, Przemyslaw <przemyslaw.hawrylewicz.czarnowski@intel.com>

2 files changed, 15 insertions, 3 deletions

diff --git a/src/smb.hpp b/src/smb.hpp
index c34a6c5..37e1a41 100644
--- a/src/smb.hpp
+++ b/src/smb.hpp
@@ -7,6 +7,7 @@
 
 #include <filesystem>
 #include <optional>
+#include <string>
 
 namespace fs = std::filesystem;
 
@@ -34,6 +35,12 @@ class SmbShare
         }
         else
         {
+            if (!validateUsername(credentials->user()))
+            {
+                LogMsg(Logger::Error,
+                       "Username for CIFS share can't contain ',' character");
+                return false;
+            }
             credentials->escapeCommas();
             credentialsOpt = "user=" + credentials->user() +
                              ",password=" + credentials->password();
@@ -63,6 +70,12 @@ class SmbShare
   private:
     std::string mountDir;
 
+    /* Check if username does not contain comma (,) character */
+    bool validateUsername(const std::string& username)
+    {
+        return username.find(',') == std::string::npos;
+    }
+
     int mountWithSmbVers(const fs::path& remote, std::string options,
                          const std::string& version)
     {
diff --git a/src/utils.hpp b/src/utils.hpp
index ebbdaf6..fd2e320 100644
--- a/src/utils.hpp
+++ b/src/utils.hpp
@@ -1,13 +1,13 @@
 #pragma once
 
+#include <algorithm>
 #include <boost/process/async_pipe.hpp>
 #include <boost/type_traits/has_dereference.hpp>
-#include <cstring>
 #include <filesystem>
-#include <fstream>
 #include <memory>
 #include <sdbusplus/asio/object_server.hpp>
 #include <string>
+#include <vector>
 
 namespace fs = std::filesystem;
 
@@ -50,7 +50,6 @@ class Credentials
     {
         if (!commasEscaped)
         {
-            escapeComma(userBuf);
             escapeComma(passBuf);
             commasEscaped = true;
         }