🌈 Sync 2026-07-25 08:33:42

luci-app-iperf/luasrc/controller/iperf.lua

@@ -13,34 +13,58 @@ end
 function run_test(server,proto,mode,updown,omit,parallel,transmit,bitrate)
 	luci.http.prepare_content("text/plain")
 	local iperf
+	server = tostring(server or "")
+	if not server:match("^[%w_%-]+$") then
+		luci.http.write_json({ error = "Invalid server" })
+		return
+	end
 	local addr = uci:get("iperf",server,"host")
 	local ports = uci:get("iperf",server,"ports")
 	local user = uci:get("iperf",server,"user") or ""
 	local password = uci:get("iperf",server,"password") or ""
 	local key = uci:get("iperf",server,"key") or ""
-	local options = ""
+	if not addr or not ports then
+		luci.http.write_json({ error = "Invalid server" })
+		return
+	end
+	parallel = tostring(parallel or "1"):match("^%d+$") or "1"
+	omit = tostring(omit or "0"):match("^%d+$") or "0"
+	transmit = tostring(transmit or "10"):match("^%d+$") or "10"
+	bitrate = tostring(bitrate or "1M")
+	if not bitrate:match("^[0-9]+[KMG]?$") then
+		bitrate = "1M"
+	end
+	local options = {}
 	if user ~= "" and password ~= "" and key ~= "" then
-		luci.sys.call("echo " .. key .. " | base64 -d > /tmp/iperf.pem")
-		options = options .. " --username " .. user .. " --rsa-public-key-path /tmp/iperf.pem"
+		luci.sys.call("printf %s " .. ut.shellquote(key) .. " | base64 -d > /tmp/iperf.pem")
+		options[#options + 1] = "--username " .. ut.shellquote(user)
+		options[#options + 1] = "--rsa-public-key-path /tmp/iperf.pem"
 	end
 	if mode == "udp" then
-		options = options .. " -u -b " .. bitrate
+		options[#options + 1] = "-u -b " .. ut.shellquote(bitrate)
 	end
-	if direction == "receive" then
-		options = options .. " -R"
+	if updown == "download" or updown == "receive" then
+		options[#options + 1] = "-R"
 	end
 	local ipv = "4"
 	if proto == "ipv6" then
-		local ipv = "6"
+		ipv = "6"
 	end
 	
 	local t={}
 	for pt in ports:gmatch("([^,%s]+)") do
-		table.insert(t,pt)
+		if pt:match("^%d+$") then
+			table.insert(t,pt)
+		end
+	end
+	if #t == 0 then
+		luci.http.write_json({ error = "Invalid server port" })
+		return
 	end
 	local port = t[ math.random( #t ) ]
+	options = table.concat(options, " ")
 	if password ~= "" then
-		iperf = io.popen("omr-iperf %s -P %s -%s -O %s -t %s -J -Z %s" % {server,parallel,ipv,omit,transmit,options})
+		iperf = io.popen("omr-iperf %s -P %s -%s -O %s -t %s -J -Z %s" % {ut.shellquote(server),parallel,ipv,omit,transmit,options})
 	else
 		iperf = io.popen("iperf3 -c %s -P %s -%s -p %s -O %s -t %s -J -Z %s" % {ut.shellquote(addr),parallel,ipv,port,omit,transmit,options})
 	end
@@ -53,4 +77,4 @@ function run_test(server,proto,mode,updown,omit,parallel,transmit,bitrate)
 		end
 	end
 	return
-end
+end