update 2026-10-28 21:59:16

luci-app-quickstart/luasrc/controller/istore_backend.lua

@@ -22,7 +22,7 @@ local function sink_socket(sock, io_err)
       if not chunk then 
         return 1 
       else 
-        return sock:send(chunk)
+        return sock:sendall(chunk)
       end 
     end 
   else 
@@ -64,14 +64,17 @@ local function chunksource(sock, buffer)
 	return function()
 		local output
 		local _, endp, count = buffer:find("^([0-9a-fA-F]+);?.-\r\n")
-		while not count and #buffer <= 1024 do
+		while not count and #buffer < 1024 do
 			local newblock, code = sock:recv(1024 - #buffer)
-			if not newblock then
+			if not newblock or newblock == "" then
 				return nil, code
 			end
 			buffer = buffer .. newblock  
 			_, endp, count = buffer:find("^([0-9a-fA-F]+);?.-\r\n")
 		end
+		if not count then
+			return nil, -1, "invalid encoding"
+		end
 		count = tonumber(count, 16)
 		if not count then
 			return nil, -1, "invalid encoding"
@@ -83,6 +86,7 @@ local function chunksource(sock, buffer)
 			return output
 		else
 			output = buffer:sub(endp+1, endp+count)
+			local buffered_tail = #buffer - endp - #output
 			buffer = ""
 			if count - #output > 0 then
 				local remain, code = sock:recvall(count-#output)
@@ -92,7 +96,7 @@ local function chunksource(sock, buffer)
 				output = output .. remain
 				count, code = sock:recvall(2)
 			else
-				count, code = sock:recvall(count+2-#buffer+endp)
+				count, code = sock:recvall(2-buffered_tail)
 			end
 			if not count then
 				return nil, code

luci-app-quickstart/luasrc/controller/quickstart.lua

@@ -95,14 +95,30 @@ function auto_setup()
     -- form style
     local packages = luci.http.formvalue("packages")
     local pkgs = ""
+    local function valid_package(value)
+        return type(value) == "string" and #value <= 128 and
+            value:match("^[%w][%w%.%+_%-]*$") ~= nil
+    end
+    local function invalid_package()
+        luci.http.prepare_content("application/json")
+        luci.http.write_json({success=1, scope="params", error="Invalid package name"})
+    end
     if type(packages) == "table" then
         if #packages > 0 then
             for k, v in pairs(packages) do
+                if not valid_package(v) then
+                    invalid_package()
+                    return
+                end
                 pkgs = pkgs .. " " .. luci.util.shellquote(v)
             end
         end
     else
         if packages ~= nil and packages ~= "" then
+            if not valid_package(packages) then
+                invalid_package()
+                return
+            end
             pkgs = luci.util.shellquote(packages)
         end
     end