🌈 Sync 2026-10-01 13:09:37

luci-app-meow/root/usr/libexec/meow-api

@@ -1,4 +1,6 @@
 #!/bin/sh
+# Small, allowlisted bridge from authenticated LuCI RPC to the local HTTP API.
+# Caller-controlled hosts, ports and arbitrary API paths are never accepted.
 set -eu
 case "$#:${1:-}:${2:-}" in
     2:GET:/version|2:GET:/configs|2:GET:/connections) body='' ;;

luci-app-meow/root/usr/libexec/meow-validate

@@ -1,13 +1,14 @@
 #!/bin/sh
+# No caller-supplied CLI flags or paths: only the generated scratch token.
 set -eu
 [ "$#" -eq 1 ] || exit 1
 case "$1" in
     check) scratch=/tmp/meow-luci-check.yaml ;;
     *)
         [ "${#1}" -eq 32 ] || exit 1
-        case "$1" in *[!0-9a-f]*) exit 1 ;;
-        esac
+        case "$1" in *[!0-9a-f]*) exit 1 ;; esac
         scratch="/tmp/meow-luci-settings-$1.yaml"
         ;;
 esac
+# Delegated LuCI configuration is deliberately confined to /etc/meow.
 exec /usr/bin/meow --no-external-plugins -d /etc/meow -f "$scratch" -t