new plugin for Ubiquiti UAP support#6071
new plugin for Ubiquiti UAP support#6071rmorandell-pgum wants to merge 5 commits intocentreon:developfrom
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| my $instance = $1; | ||
| my $result = $options{snmp}->map_instance(mapping => $mapping, results => $snmp_result, instance => $instance); | ||
|
|
||
| if (defined($self->{option_results}->{filter_name}) && $self->{option_results}->{filter_name} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-name into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
The code is attempting to filter SNMP results using user-provided --filter-name, --filter-radio, and --filter-usage values by interpolating them directly into regex matches. This allows untrusted input to control the regex pattern, which can cause regex injection or catastrophic backtracking (ReDoS) and unintended matches. Escaping or validating the input before use or using safe matching APIs would reduce risk.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| next; | ||
| } | ||
|
|
||
| if (defined($self->{option_results}->{filter_radio}) && $self->{option_results}->{filter_radio} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-radio into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
The code filters by radio using user-provided --filter-radio interpolated directly into a regex. This exposes the matching to attacker-controlled patterns (injection or ReDoS). Input should be validated or escaped before building regex patterns.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| next; | ||
| } | ||
|
|
||
| if (defined($self->{option_results}->{filter_usage}) && $self->{option_results}->{filter_usage} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-usage into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
The code filters by usage using user-provided --filter-usage interpolated directly into a regex. This permits injection of arbitrary regex patterns and potential ReDoS. Use escaping or stricter validation to mitigate.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| next; | ||
| } | ||
|
|
||
| if (defined($self->{option_results}->{filter_name}) && $self->{option_results}->{filter_name} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-name into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
In manage_selection the --filter_name option is applied by interpolating its value into a regex check against result->{name}. This exposes regex injection / ReDoS risks from untrusted user input. Escape or validate before use.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| my $instance = $1; | ||
| my $result = $options{snmp}->map_instance(mapping => $mapping, results => $snmp_result, instance => $instance); | ||
|
|
||
| if (defined($self->{option_results}->{filter_name}) && $self->{option_results}->{filter_name} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-name into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
User-provided --filter-name is used directly in a regex to filter radio names. Unvalidated input controlling regex can lead to injection or ReDoS. Prefer escaping or validating the provided pattern.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| next; | ||
| } | ||
|
|
||
| if (defined($self->{option_results}->{filter_radio}) && $self->{option_results}->{filter_radio} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-radio into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
The code uses --filter-radio directly inside a regex match for radio values. This is user-controlled input used as a regex and can enable regex injection or ReDoS. Use escaping or restrict allowed characters/patterns.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| next; | ||
| } | ||
|
|
||
| if (defined($self->{option_results}->{filter_name}) && $self->{option_results}->{filter_name} ne '' && |
There was a problem hiding this comment.
Directly interpolating --filter-name into /.../ allows regex injection/ReDoS. Escape (quotemeta) or validate the filter before using it in a regex match.
Details
✨ AI Reasoning
The code uses user-supplied --filter-name in a regex to filter VAP names without escaping. This could enable regex injection or ReDoS from crafted input. Input should be sanitized or escaped (e.g., quotemeta) before usage.
🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
1 participant
Community contributors
Description
New plugin for Ubiquiti access points "UAP"
Modes Available:
Type of change
How this pull request can be tested ?
UI-Combined-MIB.zip
ubiquiti-uap.github.snmpwalk.zip
Checklist
Centreon team (internal PR)
Description
PLEASE MAKE SURE THAT THE BRANCH PR INCLUDES JIRA TICKET ID
Please include a short resume of the changes and what is the purpose of this pull request.
Any relevant information should be added to help reviewers to understand what are the stakes
of the pull request.
Fixes # (issue)
If you are fixing a github Issue already existing, mention it here.
If you are fixing one or more JIRA ticket, mention it here too.
Type of change
How this pull request can be tested ?
Please describe the procedure to verify that the goal of the PR is matched.
Provide clear instructions so that it can be correctly tested.
Mention the automated tests included in this FOR (what they test like mode/option combinations).
Checklist
Summary by Aikido
🚀 New Features
More info