sms: sanitize decoded alphanumeric SMS addresses

Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.

Sanitize the decoded address by removing all control characters.

Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>

src/mm-modem-helpers.c

@@ -5936,3 +5936,24 @@ mm_dtmf_split (const gchar *dtmf)
 
     return array;
 }
+
+/*****************************************************************************/
+
+void
+mm_utils_remove_control_characters (gchar *str)
+{
+    gchar *src = str;
+    gchar *dst = str;
+
+    if (!str)
+        return;
+
+    while (*src) {
+        if (((guint8)*src) >= 0x20) {
+            *dst = *src;
+            dst++;
+        }
+        src++;
+    }
+    *dst = '\0';
+}

src/mm-modem-helpers.h

@@ -571,6 +571,8 @@ gboolean mm_parse_supl_address (const gchar  *supl,
                                 guint16      *out_port,
                                 GError      **error);
 
+void mm_utils_remove_control_characters (gchar *str);
+
 gboolean mm_validate_cbs_channels (GArray   *channels,
                                    GError  **error);
 

src/mm-sms-part-3gpp.c

@@ -28,6 +28,7 @@
 #include "mm-sms-part-3gpp.h"
 #include "mm-charsets.h"
 #include "mm-log.h"
+#include "mm-modem-helpers.h"
 
 #define PDU_SIZE 200
 
@@ -141,6 +142,8 @@ sms_decode_address (const guint8  *address,
         unpacked = mm_charset_gsm_unpack (address, (len_digits * 4) / 7, 0, &unpacked_len);
         unpacked_array = g_byte_array_new_take (unpacked, unpacked_len);
         utf8 = mm_modem_charset_bytearray_to_utf8 (unpacked_array, MM_MODEM_CHARSET_GSM, FALSE, error);
+        if (utf8)
+            mm_utils_remove_control_characters (utf8);
     } else if (addrtype == SMS_NUMBER_TYPE_INTL &&
                addrplan == SMS_NUMBER_PLAN_TELEPHONE) {
         /* International telphone number, format as "+1234567890" */

src/tests/test-modem-helpers.c

@@ -4872,6 +4872,25 @@ test_at_quote_string (void *f, gpointer d)
     }
 }
 
+static void
+test_remove_control_characters (void *f, gpointer d)
+{
+    gchar str1[] = "hello\r\nworld";
+    gchar str2[] = "no_controls";
+    gchar str3[] = "\r\n\t";
+
+    mm_utils_remove_control_characters (str1);
+    g_assert_cmpstr (str1, ==, "helloworld");
+
+    mm_utils_remove_control_characters (str2);
+    g_assert_cmpstr (str2, ==, "no_controls");
+
+    mm_utils_remove_control_characters (str3);
+    g_assert_cmpstr (str3, ==, "");
+
+    mm_utils_remove_control_characters (NULL);
+}
+
 /*****************************************************************************/
 
 typedef struct {
@@ -5418,6 +5437,7 @@ int main (int argc, char **argv)
     g_test_suite_add (suite, TESTCASE (test_bcd_to_string, NULL));
 
     g_test_suite_add (suite, TESTCASE (test_at_quote_string, NULL));
+    g_test_suite_add (suite, TESTCASE (test_remove_control_characters, NULL));
 
     g_test_suite_add (suite, TESTCASE (test_cpol_response, NULL));