Public bug reported:

When writing the wireless YAML config file, the SSID and password are
written as YAML unquoted string literal. This leads to invalid YAML when
the SSID contains ": ", when the SSID or password starts with ', ", @,
&, and possibly other characters/sequences. Also, SSIDs and passwords
that themselves are quoted strings, will effectively be stored without
quotes (the quotes contained in them will be part of YAML syntax and not
of the SSID/password).

Examples of SSIDs/passwords failing, one per line:

@Home
old network: don't use
'60s museum
"to be or not to be"
@VerySecretP@ssword

In some languages it is not uncommon to start words/sentences with an
apostrophe, leading to the same issue as with the '60s museum example.

The observed behavior is: When using the installer, WiFi is setup
correctly, but the config file as written is invalid, so after first
boot, WiFi is not connecting and an obscure YAML syntax error is logged
somewhere.

The expected behavior is: When using the installer, WiFi is setup
correctly and the password is written in YAML file with quotes. Single-
Quoted style looks best, where only single quote needs to be escaped by
duplicating the character, so the examples of failing items would be
encoded as such:

'@Home'
'old network: don''t use'
'''60s museum'
'"to be or not to be"'
'@VerySecretP@ssword'

Single-Quoted style supports printable characters, which sounds like a
good fit for user-input SSIDs and passwords. Although quoting is often
not needed, it seems wise to always quote freeform user input - who
knows what future YAML standards/parsers may do.

Reference: https://yaml.org/spec/1.2.2/#732-single-quoted-style

This bug affects Ubuntu netcfg (not Debian) and is present from at least
version 18, aka Bionic, up to what I believe is the current development
branch I cloned from a git repository.

I have a simple patch available and will be investigating how to format
and submit it. As I understood, the first step is reporting a bug, so
here goes!

** Affects: netcfg (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1952549

Title:
  SSID and password not properly quoted/escaped when writing YAML

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/netcfg/+bug/1952549/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to