From d298f9bc8e735ad14eef6c989d50c21a241bbe55 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Fri, 10 Jul 2026 14:34:59 +0200
Subject: [PATCH] sysupdate: generalize feature name validity check

Let's switch to string_is_safe(), and make this available to the rest of
the sysupdate sources too.

This both relaxes and tighten the rules slightly. i.e. control character
and stuff are no longer allowed, but valid UTF-8 (as opposed to ASCII)
now is.
---
 src/sysupdate/meson.build      |  2 +-
 src/sysupdate/sysupdate-util.c | 11 +++++++++++
 src/sysupdate/sysupdate-util.h |  2 ++
 src/sysupdate/sysupdated.c     | 19 ++-----------------
 4 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/src/sysupdate/meson.build b/src/sysupdate/meson.build
index 664f439f79..c4f569096f 100644
--- a/src/sysupdate/meson.build
+++ b/src/sysupdate/meson.build
@@ -39,7 +39,7 @@ executables += [
                 'name' : 'systemd-sysupdated',
                 'dbus' : true,
                 'conditions' : ['ENABLE_SYSUPDATED'],
-                'sources' : files('sysupdated.c', 'sysupdate-target.c'),
+                'sources' : files('sysupdated.c', 'sysupdate-target.c', 'sysupdate-util.c'),
         },
         executable_template + {
                 'name' : 'updatectl',
diff --git a/src/sysupdate/sysupdate-util.c b/src/sysupdate/sysupdate-util.c
index 8b0a4924e4..579c107154 100644
--- a/src/sysupdate/sysupdate-util.c
+++ b/src/sysupdate/sysupdate-util.c
@@ -31,6 +31,17 @@ int reboot_now(void) {
         return 0;
 }
 
+bool feature_name_valid(const char *c) {
+
+        if (!string_is_safe(c, STRING_FILENAME_PART))
+                return false;
+
+        /* Stack allocation is safe, since STRING_FILENAME_PART includes a length check */
+        const char *j = strjoina(c, ".feature.d");
+
+        return filename_is_valid(j);
+}
+
 bool component_name_valid(const char *c) {
         /* See if the specified string enclosed in the directory prefix+suffix would be a valid file name */
 
diff --git a/src/sysupdate/sysupdate-util.h b/src/sysupdate/sysupdate-util.h
index 07d9def708..6d5230f1e3 100644
--- a/src/sysupdate/sysupdate-util.h
+++ b/src/sysupdate/sysupdate-util.h
@@ -8,5 +8,7 @@ int reboot_now(void);
 #define SD_SYSUPDATE_OFFLINE   (UINT64_C(1) << 0)
 #define SD_SYSUPDATE_FLAGS_ALL (SD_SYSUPDATE_OFFLINE)
 
+bool feature_name_valid(const char *c);
+
 bool component_name_valid(const char *c);
 int get_component_list(const char *root, char ***ret);
diff --git a/src/sysupdate/sysupdated.c b/src/sysupdate/sysupdated.c
index 8022fde77e..bc5a2439b5 100644
--- a/src/sysupdate/sysupdated.c
+++ b/src/sysupdate/sysupdated.c
@@ -32,7 +32,6 @@
 #include "notify-recv.h"
 #include "os-util.h"
 #include "parse-util.h"
-#include "path-util.h"
 #include "pidref.h"
 #include "process-util.h"
 #include "runtime-scope.h"
@@ -42,7 +41,6 @@
 #include "strv.h"
 #include "sysupdate-target.h"
 #include "sysupdate-util.h"
-#include "utf8.h"
 
 #define FEATURES_DROPIN_NAME "systemd-sysupdate-enabled"
 
@@ -1404,19 +1402,6 @@ static int target_method_list_features(sd_bus_message *msg, void *userdata, sd_b
         return sd_bus_message_send(reply);
 }
 
-static bool feature_name_is_valid(const char *name) {
-        if (isempty(name))
-                return false;
-
-        if (!ascii_is_valid(name))
-                return false;
-
-        if (!filename_is_valid(strjoina(name, ".feature.d")))
-                return false;
-
-        return true;
-}
-
 static int target_method_describe_feature(sd_bus_message *msg, void *userdata, sd_bus_error *error) {
         Target *t = ASSERT_PTR(userdata);
         _cleanup_(job_freep) Job *j = NULL;
@@ -1430,7 +1415,7 @@ static int target_method_describe_feature(sd_bus_message *msg, void *userdata, s
         if (r < 0)
                 return r;
 
-        if (!feature_name_is_valid(feature))
+        if (!feature_name_valid(feature))
                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid feature name");
 
         if (flags != 0)
@@ -1470,7 +1455,7 @@ static int target_method_set_feature_enabled(sd_bus_message *msg, void *userdata
         r = sd_bus_message_read(msg, "sit", &feature, &enabled, &flags);
         if (r < 0)
                 return r;
-        if (!feature_name_is_valid(feature))
+        if (!feature_name_valid(feature))
                 return sd_bus_reply_method_errorf(msg,
                                                   SD_BUS_ERROR_INVALID_ARGS,
                                                   "The specified feature is invalid");