Skip to content

RDKB-66750: Mythos Defect Remediation - #454

Open
yogeswaransky wants to merge 26 commits into
developfrom
topic/RDKB-66750
Open

yogeswaransky wants to merge 26 commits into
developfrom
topic/RDKB-66750

Conversation

@yogeswaransky

Copy link
Copy Markdown
Contributor

No description provided.

Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 21, 2026 12:02
@yogeswaransky
yogeswaransky requested a review from a team as a code owner October 21, 2026 12:02
Comment thread source/utils/t2common.c Fixed
Comment thread source/utils/t2common.c Fixed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

File-opening and destination-validation security gaps remain, alongside URL rejection and schedule-error regressions.

4 open issues
What changed in this PR

Addresses RDKB-66750 by hardening temporary-file handling, profile parsing, and report generation in Telemetry 2.0.

Changes:

  • Adds shared temporary-file helpers and adopts them for HTTP output and readiness flags.
  • Adds HTTPS upload URL validation and updates parser tests.
  • Bounds schedule-string and regex-result copies.
File Description
source/​utils/​t2common.h Declares temporary-file helpers.
source/​utils/​t2common.c Implements file validation and creation helpers.
source/​test/​t2parser/​t2parserxconfTest.cpp Updates HTTPS fixtures and adds URL rejection coverage.
source/​t2parser/​t2parserxconf.c Validates upload URLs and bounds schedule parsing.
source/​reportgen/​reportgen.c Bounds regex-result formatting.
source/​protocol/​http/​multicurlinterface.c Adopts file helpers and state-red checking.
source/​bulkdata/​t2eventreceiver.c Replaces shell-based readiness flag creation.
source/​bulkdata/​reportprofiles.c Uses shared helpers for initialization flags.

Review effort: Balanced

Comment thread source/t2parser/t2parserxconf.c Outdated
Comment thread source/utils/t2common.c Outdated
Comment thread source/t2parser/t2parserxconf.c
Comment thread source/t2parser/t2parserxconf.c Outdated
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 21, 2026 12:52

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread source/t2parser/t2parserxconf.c
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 22, 2026 09:04

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 22, 2026 10:41

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The IPv4 range masks still allow invalid multicast and reserved upload destinations through validation.

4 open issues
1 previously missed issue

In code that hasn't changed since last review

Medium severity Reject complete multicast and reserved IPv4 ranges

source/​t2parser/​t2parserxconf.c:192

These masks reject only 224.0.0.0/8 and 240.0.0.0/8, rather than the full multicast (224.0.0.0/4) and reserved (240.0.0.0/4) ranges. For example, https://239.1.2.3/upload passes validation even though multicast is not a usable unicast HTTPS destination. Use a /4 mask for both checks so these invalid destinations are rejected when the profile is parsed.

1 resolved since last review

Review effort: Balanced

Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 22, 2026 11:57
@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot AI balanced review requested due to automatic review settings October 22, 2026 12:02
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread source/bulkdata/reportprofiles.c
Comment thread source/t2parser/t2parserxconf.c Outdated
…ck range'

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |41.7%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |86.3%    293| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.9%  10596|90.6%   363|    -      0

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Cross-module security and compatibility changes require human validation before safe approval can be established.

5 open issues
1 resolved since last review

Review effort: Balanced

Copilot AI balanced review requested due to automatic review settings October 23, 2026 09:26
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread source/t2parser/t2parserxconf.c Outdated
@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |40.4%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |86.3%    293| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.9%  10596|90.6%   363|    -      0

@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |40.4%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |85.9%    304| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.9%  10607|90.6%   363|    -      0

…ile resources'

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 23, 2026 09:58
…mes before loopback validation'

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Oversized-event rejection still formats full payloads into logs, causing input-sized allocations while the event mutex is held.

1 open issue
2 previously missed issues

In code that hasn't changed since last review

Medium severity Oversized warning logs full payload under mutex

source/​bulkdata/​t2eventreceiver.c:147

In T2ER_PushDataWithDelim(), this new rejection warning formats the entire oversized name and value while erMutex is held. T2Log() allocates space for the full formatted message (source/utils/t2log_wrapper.c:62-81), so rejected input still causes payload-sized allocations and log output, undermining the event-size limit. Use a fixed message here; isValidEventLength() already logs the measured lengths.

Medium severity Direct push warning logs oversized payload under mutex

source/​bulkdata/​t2eventreceiver.c:235

The direct T2ER_Push() entry point also echoes the entire oversized name and value in its new rejection warning. T2Log() allocates space for the full formatted message (source/utils/t2log_wrapper.c:62-81), so rejected events can still cause payload-sized allocations and log output while erMutex is held. Bound this message independently of the delimited-event entry point; the validator already logs the measured lengths.

4 resolved since last review

Review effort: Balanced

Copilot AI balanced review requested due to automatic review settings October 23, 2026 10:06
@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |40.4%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |84.5%    309| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.8%  10612|90.6%   363|    -      0

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

A trailing DNS root dot bypasses the new local-domain upload restrictions.

2 open issues

Review effort: Balanced

Comment thread source/t2parser/t2parserxconf.c
@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |40.4%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |84.5%    309| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.8%  10612|90.6%   363|    -      0

shibu-kv
shibu-kv previously approved these changes Oct 23, 2026
@github-actions

Copy link
Copy Markdown

Code Coverage Summary

                                         |Lines       |Functions  |Branches    
Filename                                  |Rate     Num|Rate    Num|Rate     Num
================================================================================
[/mnt/L1_CONTAINER_SHARED_VOLUME/source/]
bulkdata/datamodel.c                      |72.5%    218|88.9%     9|    -      0
bulkdata/profile.c                        |27.0%   1130|73.5%    34|    -      0
bulkdata/profilexconf.c                   |48.3%    528|85.0%    20|    -      0
bulkdata/reportprofiles.c                 |55.6%    608| 100%    27|    -      0
bulkdata/t2eventreceiver.c                |63.3%    319| 100%    11|    -      0
bulkdata/t2markers.c                      |80.5%    169|83.3%    12|    -      0
ccspinterface/busInterface.c              |86.8%     53|85.7%     7|    -      0
ccspinterface/rbusInterface.c             |74.3%    946|97.2%    36|    -      0
commonlib/telemetry_busmessage_sender.c   |40.4%    396|84.2%    19|    -      0
dcautil/dca.c                             |73.0%    690| 100%    20|    -      0
dcautil/dcaproc.c                         |84.3%    230| 100%     7|    -      0
dcautil/dcautil.c                         |78.9%    185| 100%     6|    -      0
dcautil/legacyutils.c                     |79.0%    105| 100%     7|    -      0
privacycontrol/rdkservices_privacyutils.c | 100%     11| 100%     2|    -      0
protocol/http/curlinterface.c             | 100%     24| 100%     3|    -      0
protocol/http/multicurlinterface.c        |57.1%    431|83.3%    12|    -      0
protocol/rbusMethod/rbusmethodinterface.c |60.0%    105|50.0%     6|    -      0
reportgen/reportgen.c                     |55.0%    936| 100%    21|    -      0
scheduler/scheduler.c                     |70.2%    413| 100%    13|    -      0
t2parser/t2parser.c                       |59.2%   1967|88.5%    26|    -      0
t2parser/t2parserxconf.c                  |84.5%    309| 100%     5|    -      0
utils/persistence.c                       |78.7%    253| 100%    10|    -      0
utils/t2MtlsUtils.c                       |82.6%     46|75.0%     4|    -      0
utils/t2collection.c                      |89.6%    201| 100%    18|    -      0
utils/t2common.c                          |60.7%    234|77.8%    18|    -      0
utils/t2log_wrapper.c                     |69.2%     26|50.0%     2|    -      0
utils/vector.c                            |94.9%     79| 100%     8|    -      0
================================================================================
                                   Total:|60.8%  10612|90.6%   363|    -      0

Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Comment thread source/dcautil/dca.c
T2Info("Log file resolved to approved path: %s\n", logFilePath);
T2Debug("Opening log file %s\n", logFilePath);
int fd = open(logFilePath, O_RDONLY);
int fd = open(logFilePath, O_RDONLY | O_NOFOLLOW);
Comment thread source/dcautil/dca.c
}

int rd = open(rotatedlogFilePath, O_RDONLY);
int rd = open(rotatedlogFilePath, O_RDONLY | O_NOFOLLOW);
Comment thread source/utils/t2common.c Fixed
Comment thread source/utils/t2common.c Fixed
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Signed-off-by: Yogeswaran K <Yogeswaransky@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants