[Kairamkondabhargavi]

RDKB-66994 : xconf issues
Reason for change: Fix High-priority issues in xconf-client component
Test Procedure: manual execution
Risks: Low
Priority: P1

[Copilot]

🟡 Changes recommended

Predictable signing files expose privileged writes to symlink attacks, while validation failures leave stale markers that block future updates, alongside request-value and URL-validation regressions.

7 open issues

• The script creates /tmp/.downloadingfw at line 1429 before reaching these new validation exits. Any… · New
• The predictable PID-based signing file in shared /tmp can be pre-created, allowing the privileged… · New
• The download-in-progress marker is created at line 1221 before these new validation exits. Exiting… · New
• The recovery payload still appends &recovery="true" at line 591. Passing "$JSONSTR" directly… · New
• POSTSTR still contains literal double quotes around all three capability names. The old eval… · New
• CB_CAPABILITIES still embeds double quotes around RCDL and supportsFullHttpUrl (line 570). Removing… · New
• This expression rejects valid directory URLs ending in a slash, such as… · New

What changed in this PR

This PR addresses RDKB-66994 by hardening XConf firmware-update requests and scheduling scripts.

Changes:

• Replaces several eval calls with direct command invocations.
• Adds URL, filename, and cron-pattern validation and filters partner/account identifiers.
• Moves Codebig signing output to PID-based temporary files with a restrictive permission mask.

File	Description
scripts/​xb3_firmwareDwnld.sh	Adds firmware-input validation and safer curl/signing invocations.
scripts/​xb3_codebig_firmwareDwnld.sh	Updates request execution, input validation, and signing-file handling.
scripts/​firmwareSched.sh	Validates cron patterns extracted from configuration responses.
scripts/​cbr_firmwareDwnld.sh	Adds endpoint/download validation and safer recovery and Codebig requests.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical validation bypasses and faulty download-marker handling can allow forbidden input and concurrent downloads, while stale markers can block subsequent firmware updates.

8 open issues

• Guard cleanup removes another invocation's download marker · New
• Signal traps must exit after removing the download marker · New
• Whole-argument validation is bypassed by multiline values · New
• Guard cleanup removes another invocation's download marker · New
• Signal handlers resume downloads instead of terminating · New
• Validators accept malformed multiline arguments · New
• Validators accept multiline URLs and filenames · New
• This expression rejects valid directory URLs ending in a slash, such as…

1 previously missed issue

In code that hasn't changed since last review

Codebig validation failures leave a stale download marker

scripts/​xb3_firmwareDwnld.sh:1255

The Codebig validation exits also leave /tmp/.downloadingfw behind: it was already created above, and this script has no EXIT cleanup. A rejected filename or signed server URL therefore blocks every later firmware check until something externally clears the marker. Release the owned marker on both failure paths.

6 resolved since last review

• The download-in-progress marker is created at line 1221 before these new validation exits. Exiting…
• The predictable PID-based signing file in shared /tmp can be pre-created, allowing the privileged…
• The script creates /tmp/.downloadingfw at line 1429 before reaching these new validation exits. Any…
• CB_CAPABILITIES still embeds double quotes around RCDL and supportsFullHttpUrl (line 570). Removing…
• POSTSTR still contains literal double quotes around all three capability names. The old eval…
• The recovery payload still appends &recovery="true" at line 591. Passing "$JSONSTR" directly…

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Cleanup can delete another downloader's lock, and signal handlers allow downloads to continue after termination requests, creating a risk of concurrent firmware downloads.

5 open issues

• Signal handlers resume downloads instead of terminating
• Guard cleanup removes another invocation's download marker
• Signal traps must exit after removing the download marker
• Guard cleanup removes another invocation's download marker
• This expression rejects valid directory URLs ending in a slash, such as…

1 previously missed issue

In code that hasn't changed since last review

Release lock when Codebig validation fails

scripts/​xb3_firmwareDwnld.sh:1254

The Codebig validation failures also exit after /tmp/.downloadingfw has been created, without removing it. Since this script has no EXIT cleanup handler, a rejected filename or signed server URL leaves a stale lock that makes every later invocation skip the update. Release the lock on both failure paths, or move these checks before lock acquisition.

3 resolved since last review

• Validators accept multiline URLs and filenames
• Validators accept malformed multiline arguments
• Whole-argument validation is bypassed by multiline values

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical cleanup-trap defects can delete another downloader’s lock or let signalled firmware operations continue without a lock, enabling concurrent firmware downloads.

5 open issues

• Signal handlers resume downloads instead of terminating
• Guard cleanup removes another invocation's download marker
• Signal traps must exit after removing the download marker
• Guard cleanup removes another invocation's download marker
• Accept trailing-slash directory locations · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical validation error paths leave the download-in-progress marker behind, blocking subsequent firmware upgrades until reboot or manual cleanup.

2 open issues

• Clear download marker on validation failure exits · New
• Clean up download marker on CodeBig validation failures · New

5 resolved since last review

• Signal handlers resume downloads instead of terminating
• Guard cleanup removes another invocation's download marker
• Signal traps must exit after removing the download marker
• Guard cleanup removes another invocation's download marker
• Accept trailing-slash directory locations

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Critical validation-failure paths in both firmware download scripts leave /tmp/.downloadingfw behind, blocking subsequent firmware downloads and recovery attempts despite no download having started.

1 open issue

• Clear download marker on validation failure exits

1 resolved since last review

• Clean up download marker on CodeBig validation failures

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Critical validation failure paths in the State Red SSR and direct-CDN branches leave the download-in-progress marker behind, blocking subsequent firmware recovery attempts even after the response is corrected.

1 open issue

• Clear download marker on validation failure exits

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The EXIT trap can delete another invocation’s download lock, allowing concurrent firmware downloads; cleanup must only remove a lock owned by the current invocation.

No open issues 🎉

1 resolved since last review

• Clear download marker on validation failure exits

_{Review effort: Balanced}