Check for valid subscribe path

Wiebe Cazemier
1 parent e00c635e
Showing 4 changed files with 51 additions and 0 deletions
FlashMQTests/tst_maintests.cpp
mqttpacket.cpp
utils.cpp
utils.h
@@ -44,6 +44,8 @@ private slots:
     void test_circbuf_wrapped_doubling();
     void test_circbuf_full_wrapped_buffer_doubling();
+    void test_validSubscribePath();
+
     void test_retained();
     void test_retained_changed();
     void test_retained_removed();
@@ -278,6 +280,26 @@ void MainTests::test_circbuf_full_wrapped_buffer_doubling()
     QVERIFY(true);
 }
+void MainTests::test_validSubscribePath()
+{
+    QVERIFY(isValidSubscribePath("one/two/three"));
+    QVERIFY(isValidSubscribePath("one//three"));
+    QVERIFY(isValidSubscribePath("one/+/three"));
+    QVERIFY(isValidSubscribePath("one/+/#"));
+    QVERIFY(isValidSubscribePath("#"));
+    QVERIFY(isValidSubscribePath("///"));
+    QVERIFY(isValidSubscribePath("//#"));
+    QVERIFY(isValidSubscribePath("+"));
+    QVERIFY(isValidSubscribePath(""));
+
+    QVERIFY(!isValidSubscribePath("one/tw+o/three"));
+    QVERIFY(!isValidSubscribePath("one/+o/three"));
+    QVERIFY(!isValidSubscribePath("one/a+/three"));
+    QVERIFY(!isValidSubscribePath("#//three"));
+    QVERIFY(!isValidSubscribePath("#//+"));
+    QVERIFY(!isValidSubscribePath("one/#/+"));
+}
+
 void MainTests::test_retained()
 {
     TwoClientTestContext testContext;
@@ -358,6 +358,9 @@ void MqttPacket::handleSubscribe()
         if (topic.empty() || !isValidUtf8(topic))
             throw ProtocolError("Subscribe topic not valid UTF-8.");
+        if (isValidSubscribePath(topic))
+            throw ProtocolError(formatString("Invalid subscribe path: %s", topic.c_str()));
+
         char qos = readByte();
         if (qos > 2)
@@ -137,6 +137,31 @@ bool isValidPublishPath(const std::string &amp;s)
     return true;
 }
+bool isValidSubscribePath(const std::string &s)
+{
+    bool plusAllowed = true;
+    bool nextMustBeSlash = false;
+    bool poundSeen = false;
+
+    for (const char c : s)
+    {
+        if (!plusAllowed && c == '+')
+            return false;
+
+        if (nextMustBeSlash && c != '/')
+            return false;
+
+        if (poundSeen)
+            return false;
+
+        plusAllowed = c == '/';
+        nextMustBeSlash = c == '+';
+        poundSeen = c == '#';
+    }
+
+    return true;
+}
+
 bool containsDangerousCharacters(const std::string &s)
 {
     if (s.empty())
@@ -37,6 +37,7 @@ bool isValidUtf8(const std::string &amp;s);
 bool strContains(const std::string &s, const std::string &needle);
 bool isValidPublishPath(const std::string &s);
+bool isValidSubscribePath(const std::string &s);
 bool containsDangerousCharacters(const std::string &s);
 void ltrim(std::string &s);