🎉 Sync 2026-10-24 00:22:39

luci-app-mptcp/root/usr/libexec/rpcd/luci.mptcp

@@ -44,7 +44,16 @@ end
 -- The trailing comma is determined by file position, not by whether the next entry is
 -- non-zero: when the circular buffer is partially filled the last valid row still gets
 -- a trailing comma.  Strip it before wrapping with "[...]" to produce valid JSON.
+-- luci-bwc appends the name to its database directory as is: from the read
+-- method interface_bandwidth, "../../../../etc/shadow" printed the start of
+-- any file. Only a name the kernel accepts for a device (dev_valid_name):
+-- not whether it exists, a device just gone still has its graph.
+-- A string only: a legacy "list ifname" is a table, and dev:find on it
+-- raised an error that failed the whole multipath_bandwidth call.
 local function bwc_rows(dev)
+	if type(dev) ~= "string" or dev == "" or #dev > 15 or dev == "." or dev == ".." or dev:find("[/:%s]") then
+		return {}
+	end
 	local f = io.popen("luci-bwc -i " .. shell_quote(dev) .. " 2>/dev/null")
 	if not f then return {} end
 	local output = f:read("*all")
@@ -593,6 +602,12 @@ local function valid_uint(v, max)
 	return v:match("^%d+$") ~= nil and n ~= nil and (max == nil or n <= max)
 end
 
+-- 1 to 256, as "ip route" takes it and the forms ask: the BPF schedulers
+-- read 0 as no weight (neutral 100) and add the weight to a signed counter
+local function valid_weight(v)
+	return type(v) == "string" and valid_uint(v, 256) and tonumber(v) >= 1
+end
+
 local function valid_name(v)
 	return v:match("^[%w_]+$") ~= nil
 end
@@ -804,7 +819,7 @@ local methods = {
 				return { error = "Invalid value for multipath" }
 			end
 			if (args.multipath_weight or "") ~= "" and
-			   not valid_uint(args.multipath_weight) then
+			   not valid_weight(args.multipath_weight) then
 				return { error = "Invalid value for multipath_weight" }
 			end
 			if mp ~= "" then