1083861 - The regex for the commands allows injection of characters prior to rpp

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia, defect)

Description

[Wilfred Mathanaraj [:WDM]]

Impact: no direct impact currently, but unexpected application flow make causes issues in the future. 

Fix: match ^rpp instead of just rpp

Comment 1

[marta]

Attachment: bug_1083861.patch

Comment 2

[Frederik Braun [:freddy]]

Comment on attachment 8507719 [details] [diff] [review]
bug_1083861.patch

Review of attachment 8507719 [details] [diff] [review]:
-----------------------------------------------------------------

::: dev_apps/privacy-panel/js/privacy-panel.js
@@ +238,4 @@
>     */
>    _onSMSReceived: function(event) {
>      var match, cmd, passkey, body = event.message.body,
> +        rgx = /^rpp\s(lock|ring|locate|wipe)\s([a-z0-9]{1,100})$/i;

With the wipe command left out, it should be removed from the regular expression.

(With the very small patch details bugzilla is showing me it also looks like "rgx" is not declared as "var rgx" (or "let rgx") and thus not properly bound to a scope. If this has not been done elswhere in the code, it will leak in the global scope)

Comment 3

[marta]

Attachment: bug_1083861_new.patch