openc3 7.3.0 → 7.4.0

data/ext/openc3/ext/structure/structure.c

@@ -18,6 +18,7 @@
 */
 
 #include "ruby.h"
+#include "stdint.h"
 #include "stdio.h"
 
 #define TO_BIGNUM(x) (FIXNUM_P(x) ? rb_int2big(FIX2LONG(x)) : x)
@@ -400,11 +401,13 @@ static void check_bit_offset_and_size(VALUE self, VALUE type_param, VALUE bit_of
 
   if (bit_offset < 0)
   {
-    bit_offset = ((int)(RSTRING_LEN(buffer_param) * 8) + bit_offset);
-    if (bit_offset < 0)
+    /* Calculate in 64 bits since a large buffer times 8 does not fit in an int */
+    int64_t calculated_bit_offset = (((int64_t)RSTRING_LEN(buffer_param)) * 8) + bit_offset;
+    if ((calculated_bit_offset < 0) || (calculated_bit_offset > INT32_MAX))
     {
       rb_funcall(self, id_method_raise_buffer_error, 5, type_param, buffer_param, data_type_param, bit_offset_param, bit_size_param);
     }
+    bit_offset = (int)calculated_bit_offset;
   }
 
   *new_bit_offset = bit_offset;
@@ -418,23 +421,45 @@ static int even_bit_size(int bit_size)
 
 /* Calculate the bounds of the string to access the item based on the bit_offset and bit_size.
  * Also determine if the buffer size is sufficient. */
-static int check_bounds_and_buffer_size(int bit_offset, int bit_size, int buffer_length, VALUE endianness, VALUE data_type, int *lower_bound, int *upper_bound)
+static int check_bounds_and_buffer_size(int bit_offset, int bit_size, long buffer_length, VALUE endianness, VALUE data_type, int *lower_bound, int *upper_bound)
 {
   int result = 1; /* Assume ok */
-
-  /* Define bounds of string to access this item */
-  *lower_bound = bit_offset / 8;
-  *upper_bound = (bit_offset + bit_size - 1) / 8;
+  int64_t calculated_lower_bound = 0;
+  int64_t calculated_upper_bound = 0;
+
+  /* Calculate in 64 bits so attacker-controlled offsets and sizes cannot
+   * overflow before the buffer bounds are checked. */
+  calculated_lower_bound = ((int64_t)bit_offset) / 8;
+  calculated_upper_bound = (((int64_t)bit_offset) + ((int64_t)bit_size) - 1) / 8;
+  *lower_bound = (int)calculated_lower_bound;
+  *upper_bound = (int)calculated_upper_bound;
+
+  /* The read starts at lower_bound, so it must be checked independently of
+   * upper_bound. Also reject reversed bounds before considering the special
+   * little-endian bitfield case below. */
+  if ((calculated_lower_bound < 0) ||
+      (calculated_lower_bound >= buffer_length) ||
+      (calculated_upper_bound < calculated_lower_bound))
+  {
+    return 0;
+  }
 
   /* Sanity check buffer size */
-  if (*upper_bound >= buffer_length)
+  if (calculated_upper_bound >= buffer_length)
   {
     /* If it's not the special case of little endian bit field then we fail and return 0 */
+    /* Note lower_bound is already known to be inside the buffer */
     if (!((endianness == symbol_LITTLE_ENDIAN) &&
           ((data_type == symbol_INT) || (data_type == symbol_UINT)) &&
           /* Not byte aligned with an even bit size */
-          (!((BYTE_ALIGNED(bit_offset)) && (even_bit_size(bit_size)))) &&
-          (*lower_bound < buffer_length)))
+          (!((BYTE_ALIGNED(bit_offset)) && (even_bit_size(bit_size))))))
+    {
+      result = 0;
+    }
+    /* Little endian bitfields are accessed backwards from bit_offset, so the bytes
+     * they span must all be inside the buffer. Checking this here keeps a huge
+     * bit_size from allocating memory before it is rejected. */
+    else if ((calculated_lower_bound - ((((bit_offset % 8) + ((int64_t)bit_size) - 1) / 8) + 1) + 1) < 0)
     {
       result = 0;
     }
@@ -456,8 +481,8 @@ static int check_bounds_and_buffer_size(int bit_offset, int bit_size, int buffer
 static VALUE binary_accessor_read(VALUE self, VALUE param_bit_offset, VALUE param_bit_size, VALUE param_data_type, VALUE param_buffer, VALUE param_endianness)
 {
   /* Convert Parameters to C Data Types */
-  int bit_offset = FIX2INT(param_bit_offset);
-  int bit_size = FIX2INT(param_bit_size);
+  int bit_offset = NUM2INT(param_bit_offset);
+  int bit_size = NUM2INT(param_bit_size);
 
   /* Local Variables */
   int given_bit_offset = bit_offset;
@@ -502,18 +527,20 @@ static VALUE binary_accessor_read(VALUE self, VALUE param_bit_offset, VALUE para
    * recalculate based on the buffer length */
   if ((bit_size <= 0) && ((param_data_type == symbol_STRING) || (param_data_type == symbol_BLOCK)))
   {
-    bit_size = (((int)buffer_length * 8) - bit_offset + bit_size);
-    if (bit_size == 0)
+    /* Calculate in 64 bits since a large buffer times 8 does not fit in an int */
+    int64_t calculated_bit_size = (((int64_t)buffer_length) * 8) - bit_offset + bit_size;
+    if (calculated_bit_size == 0)
     {
       return rb_str_new2("");
     }
-    else if (bit_size < 0)
+    else if ((calculated_bit_size < 0) || (calculated_bit_size > INT32_MAX))
     {
       rb_funcall(self, id_method_raise_buffer_error, 5, symbol_read, param_buffer, param_data_type, param_bit_offset, param_bit_size);
     }
+    bit_size = (int)calculated_bit_size;
   }
 
-  if (!check_bounds_and_buffer_size(bit_offset, bit_size, (int)buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound))
+  if (!check_bounds_and_buffer_size(bit_offset, bit_size, buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound))
   {
     /* Return nil for out-of-bounds reads (supports undersized packets with ALLOW_SHORT) */
     return Qnil;
@@ -1005,10 +1032,15 @@ static VALUE binary_accessor_write(VALUE self, VALUE value, VALUE param_bit_offs
     {
       value = rb_funcall(value, id_method_to_s, 0);
     }
+    /* Calculate in 64 bits since a large value times 8 does not fit in an int */
+    if ((((int64_t)RSTRING_LEN(value)) * 8) > INT32_MAX)
+    {
+      rb_funcall(self, id_method_raise_buffer_error, 5, symbol_write, param_buffer, param_data_type, param_bit_offset, param_bit_size);
+    }
     bit_size = (int)RSTRING_LEN(value) * 8;
   }
 
-  if ((!check_bounds_and_buffer_size(bit_offset, bit_size, (int)buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound)) && (given_bit_size > 0))
+  if ((!check_bounds_and_buffer_size(bit_offset, bit_size, buffer_length, param_endianness, param_data_type, &lower_bound, &upper_bound)) && (given_bit_size > 0))
   {
     rb_funcall(self, id_method_raise_buffer_error, 5, symbol_write, param_buffer, param_data_type, param_bit_offset, param_bit_size);
   }

data/lib/openc3/accessors/binary_accessor.rb

@@ -105,35 +105,70 @@ module OpenC3
     HOST_ENDIANNESS = get_host_endianness()
     # Valid endianness
     ENDIANNESS = [:BIG_ENDIAN, :LITTLE_ENDIAN]
+    NATIVE_INT_MIN = -(2**31)
+    NATIVE_INT_MAX = (2**31) - 1
 
-    def handle_read_variable_bit_size(item, _buffer)
+    def handle_read_variable_bit_size(item, buffer)
       length_value = @packet.read(item.variable_bit_size['length_item_name'], :CONVERTED)
       # length_value can be nil when reading an undersized packet where the length
       # item falls outside the buffer bounds
       raise "Length value #{item.variable_bit_size['length_item_name']} for item #{item.name} is nil" if length_value.nil?
 
       if item.array_size
-        item.array_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+        array_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+        validate_variable_bit_size(item, array_size, buffer)
+        item.array_size = array_size
       else
         if item.data_type == :INT or item.data_type == :UINT
           # QUIC encoding is currently assumed for individual variable sized integers
           # see https://datatracker.ietf.org/doc/html/rfc9000#name-variable-length-integer-enc
           case length_value
           when 0
-            item.bit_size = 6
+            bit_size = 6
           when 1
-            item.bit_size = 14
+            bit_size = 14
           when 2
-            item.bit_size = 30
+            bit_size = 30
           else
-            item.bit_size = 62
+            bit_size = 62
           end
         else
-          item.bit_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
+          bit_size = (length_value * item.variable_bit_size['length_bits_per_count']) + item.variable_bit_size['length_value_bit_offset']
         end
+        validate_variable_bit_size(item, bit_size, buffer)
+        item.bit_size = bit_size
       end
     end
 
+    # A negative bit size is always invalid. A bit size larger than the buffer is
+    # only an error when the packet does not allow short buffers, otherwise the
+    # oversized item simply reads as nil (ALLOW_SHORT).
+    def validate_variable_bit_size(item, bit_size, buffer)
+      available_bit_size = (buffer.length * 8) - item.bit_offset
+      if bit_size < 0 || (!@packet.short_buffer_allowed && (available_bit_size < 0 || bit_size > available_bit_size))
+        raise ArgumentError, "Variable bit size #{bit_size} for item #{item.name} exceeds the #{[available_bit_size, 0].max} bits available in the buffer"
+      end
+    end
+
+    # The native accessor takes C ints, so values outside that range must be
+    # rejected here rather than raising RangeError out of the extension.
+    def native_value_out_of_range?(item)
+      [item.bit_offset, item.bit_size, item.array_size].compact.any? do |value|
+        value < NATIVE_INT_MIN || value > NATIVE_INT_MAX
+      end
+    end
+
+    # Items that derive their size from the buffer (0 or negative bit_size or
+    # array_size) calculate a negative size when the buffer ends before the item
+    # starts. Such an item is simply not present in a short buffer.
+    def derived_size_negative?(item, buffer)
+      available_bit_size = (buffer.length * 8) - item.bit_offset
+      if item.array_size
+        return item.array_size <= 0 && (available_bit_size + item.array_size) < 0
+      end
+      return item.bit_size <= 0 && (available_bit_size + item.bit_size) < 0
+    end
+
     def read_item(item, buffer)
       return nil if item.data_type == :DERIVED
       if item.parent_item
@@ -145,6 +180,9 @@ module OpenC3
         structure.read(item.key, :RAW, structure_buffer)
       else
         handle_read_variable_bit_size(item, buffer) if item.variable_bit_size
+        if @packet.short_buffer_allowed && (native_value_out_of_range?(item) || derived_size_negative?(item, buffer))
+          return nil
+        end
         self.class.read_item(item, buffer)
       end
     end
@@ -288,6 +326,11 @@ module OpenC3
         self.class.write_item(parent_item, structure_buffer, buffer)
       else
         handle_write_variable_bit_size(item, value, buffer) if item.variable_bit_size
+        # Raise the normal buffer error rather than letting the native accessor
+        # raise RangeError when converting the offset or size to a C int
+        if native_value_out_of_range?(item)
+          self.class.raise_buffer_error(:write, buffer, item.data_type, item.bit_offset, item.bit_size)
+        end
         self.class.write_item(item, value, buffer)
       end
     end
@@ -800,16 +843,27 @@ module OpenC3
         lower_bound = bit_offset / 8
         upper_bound = (bit_offset + bit_size - 1) / 8
 
+        # The access starts at lower_bound, so validate it independently rather
+        # than relying on upper_bound to imply that it is safe.
+        if lower_bound < 0 || lower_bound >= buffer_length || upper_bound < lower_bound
+          return false, lower_bound, upper_bound
+        end
+
         # Sanity check buffer size
         if upper_bound >= buffer_length
           # If it's not the special case of little endian bit field then we fail and return false
+          # Note lower_bound is already known to be inside the buffer
           if !((endianness == :LITTLE_ENDIAN) &&
                  ((data_type == :INT) || (data_type == :UINT)) &&
                  # Not byte aligned with an even bit size
-                 (!((byte_aligned(bit_offset)) && (even_bit_size(bit_size)))) &&
-                 (lower_bound < buffer_length)
+                 (!((byte_aligned(bit_offset)) && (even_bit_size(bit_size))))
               )
             result = false
+          # Little endian bitfields are accessed backwards from bit_offset, so the
+          # bytes they span must all be inside the buffer. Checking this here keeps
+          # a huge bit_size from allocating memory before it is rejected.
+          elsif (lower_bound - ((((bit_offset % 8) + bit_size - 1) / 8) + 1) + 1) < 0
+            result = false
           end
         end
         return result, lower_bound, upper_bound

data/lib/openc3/api/cmd_api.rb

@@ -484,7 +484,7 @@ module OpenC3
       user = authorize(permission: 'cmd', target_name: target_name, packet_name: cmd_name, manual: manual, scope: scope, token: token)
       if user.nil?
         user = {}
-        user['username'] = ENV['OPENC3_MICROSERVICE_NAME']
+        user['username'] = ENV.fetch('OPENC3_MICROSERVICE_NAME', nil)
 
         # Get the caller stack trace to determine the point in the code where the command was called
         # This code works but ultimately we didn't want to overload 'username' and take a performance hit

data/lib/openc3/api/metrics_api.rb

@@ -1,6 +1,6 @@
 # encoding: ascii-8bit
 
-# Copyright 2023 OpenC3, Inc
+# Copyright 2026 OpenC3, Inc.
 # All Rights Reserved.
 #
 # This program is distributed in the hope that it will be useful,

data/lib/openc3/api/offline_access_api.rb

@@ -1,6 +1,6 @@
 # encoding: ascii-8bit
 
-# Copyright 2022 OpenC3, Inc
+# Copyright 2026 OpenC3, Inc.
 # All Rights Reserved.
 #
 # This program is distributed in the hope that it will be useful,

data/lib/openc3/api/settings_api.rb

@@ -81,26 +81,30 @@ module OpenC3
 
     # Update the news feed on demand to respond to frontend setting changes
     def update_news(manual: false, scope: $openc3_scope, token: $openc3_token)
+      # Authorize outside the begin/rescue so AuthError propagates to the caller
+      # rather than being swallowed and written into the news feed
       authorize(permission: 'admin', manual: manual, scope: scope, token: token)
-      conn = Faraday.new(
-        url: 'https://news.openc3.com',
-        params: {version: VERSION, enterprise: ENTERPRISE},
-      )
-      response = conn.get('/news')
-      if response.success?
-        NewsModel.set(response.body)
-      else
-        NewsModel.news_error("Error contacting OpenC3 news feed (status: #{response.status})")
-      end
+      begin
+        conn = Faraday.new(
+          url: 'https://news.openc3.com',
+          params: {version: VERSION, enterprise: ENTERPRISE},
+        )
+        response = conn.get('/news')
+        if response.success?
+          NewsModel.set(response.body)
+        else
+          NewsModel.news_error("Error contacting OpenC3 news feed (status: #{response.status})")
+        end
 
-      # Test code to update the news feed with a dummy message
-      # data = NewsModel.all()
-      # json = JSON.parse(data)
-      # json.unshift( { date: Time.now.utc.iso8601, title: "News at #{Time.now}", body: "The news feed has been updated at #{Time.now}." })
-      # json.pop if json.length > 5
-      # NewsModel.set(json.to_json)
-    rescue Exception => e
-      NewsModel.news_error("Error contacting OpenC3 news feed. #{e.message})")
+        # Test code to update the news feed with a dummy message
+        # data = NewsModel.all()
+        # json = JSON.parse(data)
+        # json.unshift( { date: Time.now.utc.iso8601, title: "News at #{Time.now}", body: "The news feed has been updated at #{Time.now}." })
+        # json.pop if json.length > 5
+        # NewsModel.set(json.to_json)
+      rescue StandardError => e
+        NewsModel.news_error("Error contacting OpenC3 news feed. #{e.message}")
+      end
     end
 
     # Update the local copy of the plugin store data

data/lib/openc3/api/stash_api.rb

@@ -1,6 +1,6 @@
 # encoding: ascii-8bit
 
-# Copyright 2024 OpenC3, Inc
+# Copyright 2026 OpenC3, Inc.
 # All Rights Reserved.
 #
 # This program is distributed in the hope that it will be useful,

data/lib/openc3/api/tlm_api.rb

@@ -117,7 +117,8 @@ module OpenC3
     # @param packet_name [String] Packet name of the packet
     # @param item_hash [Hash] Hash of item_name and value for each item you want to change from the current value table
     # @param type [Symbol] Telemetry type, :RAW, :CONVERTED (default), :FORMATTED
-    def inject_tlm(target_name, packet_name, item_hash = nil, type: :CONVERTED, stored: false, manual: false, scope: $openc3_scope, token: $openc3_token)
+    # @param received_time [Integer, nil] Optional received time as nanoseconds since Unix epoch
+    def inject_tlm(target_name, packet_name, item_hash = nil, type: :CONVERTED, stored: false, received_time: nil, manual: false, scope: $openc3_scope, token: $openc3_token)
       authorize(permission: 'tlm_set', target_name: target_name, packet_name: packet_name, manual: manual, scope: scope, token: token)
       type = type.to_s.intern
       target_name = target_name.upcase
@@ -155,9 +156,9 @@ module OpenC3
 
       # Use an interface microservice if it exists, other use the decom microservice
       if interface_name
-        InterfaceTopic.inject_tlm(interface_name, target_name, packet_name, item_hash, type: type, stored: stored, scope: scope)
+        InterfaceTopic.inject_tlm(interface_name, target_name, packet_name, item_hash, type: type, stored: stored, received_time: received_time, scope: scope)
       else
-        DecomInterfaceTopic.inject_tlm(target_name, packet_name, item_hash, type: type, stored: stored, scope: scope)
+        DecomInterfaceTopic.inject_tlm(target_name, packet_name, item_hash, type: type, stored: stored, received_time: received_time, scope: scope)
       end
     end
 

data/lib/openc3/config/config_parser.rb

@@ -166,19 +166,46 @@ module OpenC3
       return ERB.new(read_file(template_name).comment_erb(), trim_mode: "-").result(b)
     end
 
-    # Can be called during parsing to read a referenced file
+    # Can be called during parsing to read a referenced file. The filename must
+    # be relative to the configuration file being parsed and must resolve to a
+    # location inside that file's directory.
     def read_file(filename)
-      # Assume the file is there. If not we raise a pretty obvious error
-      if File.expand_path(filename) == filename # absolute path
-        path = filename
-      else # relative to the current @filename
-        path = File.join(File.dirname(@filename), filename)
-      end
+      path = resolve_config_path(filename)
       OpenC3.set_working_dir(File.dirname(path)) do
         return File.read(path).force_encoding("UTF-8")
       end
     end
 
+    # Resolves a filename referenced by a configuration file (TEMPLATE_FILE, ERB
+    # render, etc) into an absolute path contained by the directory of the file
+    # being parsed. Absolute paths and paths containing '..' are rejected so a
+    # configuration file can not read arbitrary files on the filesystem.
+    #
+    # @param filename [String] Relative path from the configuration file
+    # @return [String] Absolute path to the referenced file
+    private def resolve_config_path(filename)
+      filename = filename.to_s
+      raise Error.new(self, "Filename must be given") if filename.strip.empty?
+
+      if File.absolute_path?(filename) or File.expand_path(filename) == filename
+        raise Error.new(self, "Absolute paths are not allowed: #{filename}")
+      end
+      if filename.include?('..')
+        raise Error.new(self, "Path traversal is not allowed: #{filename}")
+      end
+      if @filename.nil? or @filename.to_s.empty?
+        raise Error.new(self, "No configuration file is being parsed, can not resolve: #{filename}")
+      end
+
+      base = File.expand_path(File.dirname(@filename))
+      path = File.expand_path(File.join(base, filename))
+      # Final containment check in case the OS or Ruby normalizes something unexpected
+      unless path.start_with?(base + File::SEPARATOR)
+        raise Error.new(self, "Path is outside the configuration directory: #{filename}")
+      end
+      path
+    end
+
     # Processes a file and yields |config| to the given block
     #
     # @param filename [String] The full name and path of the configuration file
@@ -307,6 +334,38 @@ module OpenC3
       return value
     end
 
+    # Values handle_true_false_strict accepts. Deliberately NOT shared with
+    # handle_true_false, which passes unrecognized values through and so can't
+    # tell the number 1 from a boolean - TABLE_MANAGER item defaults rely on 1
+    # staying 1. Named and scoped so they can't be mistaken for a truth table
+    # the whole parser honors.
+    STRICT_TRUE_VALUES = ['TRUE', '1']
+    STRICT_FALSE_VALUES = ['FALSE', '0', '']
+    private_constant :STRICT_TRUE_VALUES, :STRICT_FALSE_VALUES
+
+    # Converts a String containing 'TRUE', '1', 'FALSE', '0' or '' to a true or
+    # false Ruby primitive. Unlike handle_true_false, which returns anything it
+    # doesn't recognize unchanged, an unrecognized value raises.
+    #
+    # Use this for a flag where guessing is worse than failing - notably an
+    # environment variable that is enabled by presence elsewhere in COSMOS, so
+    # that 'VAR=false' (or 'VAR=0') means off here rather than the surprising on.
+    #
+    # @param value [Object] value to convert, nil returns the default
+    # @param description [String] what the value is, used in the error message
+    # @param default [true|false] returned when value is nil
+    # @return [true|false]
+    def self.handle_true_false_strict(value, description: 'value', default: false)
+      return default if value.nil?
+      normalized = value.to_s.strip.upcase
+      return true if STRICT_TRUE_VALUES.include?(normalized)
+      return false if STRICT_FALSE_VALUES.include?(normalized)
+      # Name empty explicitly - it is accepted (as false) but isn't a value
+      # anyone can read off the list
+      raise ArgumentError, "Invalid value #{value.to_s.strip.inspect} for #{description}. " \
+                           "Must be one of: #{(STRICT_TRUE_VALUES + STRICT_FALSE_VALUES - ['']).join(', ')}, or empty"
+    end
+
     # Converts a String containing '', 'NIL', 'NULL', 'TRUE' or 'FALSE' to nil,
     # true or false Ruby primitives. All other values are simply returned.
     #
@@ -321,6 +380,8 @@ module OpenC3
           return false
         when '', 'NIL', 'NULL'
           return nil
+        else
+          # All other strings are returned unmodified below
         end
       end
       return value
@@ -378,11 +439,12 @@ module OpenC3
           return Float::INFINITY
         when 'NEG_INFINITY'
           return -Float::INFINITY
+        else
+          # NOTE: The else case does not raise because of the following scenario:
+          # If the value type is a UINT but they have a WRITE_CONVERSION that takes a string
+          # then the default value will be a string. In that case we just want to return the string.
+          # For example, the IP_ADDRESS parameter in the TIME_OFFSET command in the Demo plugin.
         end
-        # NOTE: No else case because of the following scenario:
-        # If the value type is a UINT but they have a WRITE_CONVERSION that takes a string
-        # then the default value will be a string. In that case we just want to return the string.
-        # For example, the IP_ADDRESS parameter in the TIME_OFFSET command in the Demo plugin.
       end
       return value
     end
@@ -494,8 +556,8 @@ module OpenC3
         while true
           @line_number += 1
 
-          if @@progress_callback && ((@line_number % 10) == 0)
-            @@progress_callback.call(io.pos / size) if size > 0.0
+          if @@progress_callback && ((@line_number % 10) == 0) && size > 0.0
+            @@progress_callback.call(io.pos / size)
           end
 
           begin
@@ -586,10 +648,9 @@ module OpenC3
               # KEYWORD PARAM #This is a comment
               # But still process Ruby string interpolations such as:
               # KEYWORD PARAM #{var}
-              if (string.length > 0) && (string[0] == '#')
-                if !((string.length > 1) && (string[1] == '{'))
-                  break
-                end
+              if (string.length > 0) && (string[0] == '#') &&
+                 !((string.length > 1) && (string[1] == '{'))
+                break
               end
 
               if remove_quotes