From 56ee56af2e9b1908817ffaae6e7d7b1f97e46ad8 Mon Sep 17 00:00:00 2001
From: d00f <8052722+DrDoof@users.noreply.github.com>
Date: Wed, 16 Sep 2026 23:05:11 +0200
Subject: [PATCH] cmd: keep quotes and control bytes out of names when they are
 set

The console, POST /cmd and the saved config all go through the command
parser, so one filter there covers every way a name can be set. The
hostname already did this inline; port and VLAN names now do it too.

The SFP strings still need escaping on the way out: they come from the
module's EEPROM, not from a command.
---
 cmd_parser.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/cmd_parser.c b/cmd_parser.c
index d4c4df8b..ed973db8 100644
--- a/cmd_parser.c
+++ b/cmd_parser.c
@@ -440,6 +440,14 @@ static void cmd_error(__code const char *msg)
 // re-registers the static L2 management entry so the change applies without a
 // reboot. As a regular command a "mac ..." line in the startup config applies
 // on every boot (execute_config runs before the final static L2 entry).
+static uint8_t name_char(uint8_t c)
+{
+	if (c < 0x20 || c > 0x7e || c == '"' || c == '\\')
+		return '.';
+	return c;
+}
+
+
 void parse_mac_cmd(void)
 {
 	if (cmd_words_len == 1) {
@@ -627,7 +635,7 @@ void parse_vlan(void)
 				*vlan_str++ = hex[(vlan_settings.vlan >> 4) & 0xf] ;
 				*vlan_str++ = hex[vlan_settings.vlan & 0xf];
 				while(!cmd_is_space_or_nul(pos)) {
-					uint8_t c = cmd_buffer[pos++];
+					uint8_t c = name_char(cmd_buffer[pos++]);
 					write_char(c);
 					*vlan_str++ = c;
 				}
@@ -889,7 +897,7 @@ void parse_port(void)
 	} else if (cmd_compare(2, "name")) {
 		uint8_t i = 0;
 		while ( (i < PORT_NAME_SIZE-1) && (cmd_buffer[cmd_words_b[3] + i] != NUL) ) {
-			port_names[phy_settings.port][i] = cmd_buffer[cmd_words_b[3] + i];
+			port_names[phy_settings.port][i] = name_char(cmd_buffer[cmd_words_b[3] + i]);
 			i++;
 		}
 		port_names[phy_settings.port][i] = NUL;
@@ -1831,9 +1839,7 @@ void cmd_parser(void) __banked
 					uint8_t c = *hp++;
 					if (c == NUL || c == '\r' || c == '\n')
 						break;
-					if (c < 0x20 || c > 0x7e || c == '"' || c == '\\')
-						c = '.';
-					*dst++ = c;
+					*dst++ = name_char(c);
 				}
 				*dst = NUL;
 			} else {