arduino / arduino/ArduinoCore-renesas
WiFi passwords containing a double quote, comma, or backslash are not escaped correctly when sent to the WiFi USB bridge
- Dominant language
- C
- Stars
- 193
- Forks
- 112
- PR merge metrics
- No merged PRs in 30d
Description
When serializing command arguments, the software that communicates the WiFi password to the WiFi USB bridge doesn't escape these three special characters that the firmware on the other side interprets. As a result, that firmware mis-parses passwords that contain them and fails to connect.
Sample code, which never successfully connects:
```cpp
#include
// #include "Modem.h"
void setup() {
Serial.begin(9600);
Serial.println("Starting wifi");
// modem.begin();
// modem.debug(Serial, 2);
int status = WL_IDLE_STATUS;
while(status != WL_CONNECTED) {
status = WiFi.begin("my_ssid", "goofy\"password");
Serial.print("status = ");
Serial.println(status);
delay(2000);
}
Serial.println("Connected!");
while(1);
}
void loop() {
// put your main code here, to run repeatedly:
}
```
SSID and password serialized out with no escaping here:
https://github.com/arduino/ArduinoCore-renesas/blob/ecc4ed83cd35d4ec109347615de8205d7810554c/libraries/WiFiS3/src/WiFi.cpp#L57
Relevant debugging output from the modem class (thanks to whoever put that in there!):
```text
REQUEST: AT+BEGINSTA=my_ssid,goofy"password
```
Parser code in the firmware that's interpreting the double quote:
https://github.com/arduino/uno-r4-wifi-usb-bridge/blob/94d5bb2e8c2cb5492345bfb84d787fde65d1c183/UNOR4USBBridge/parser.cpp#L161
It's possible to work around this by adding extra escaping in the string in the sketch, e.g.
```cpp
status = WiFi.begin("my_ssid", "goofy\\\"password");
```
Which results in this going over the wire, successfully connecting.
```text
REQUEST: AT+BEGINSTA=my_ssid,goofy\"password
```
### Additional context
#### Additional reports
- https://github.com/arduino/ArduinoCore-renesas/issues/430#issuecomment-3034243774
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in libraries/WiFiS3/src/WiFi.cpp at the linked serialization code and compare its output with the parser in parser.cpp at the linked firmware location. Reproduce the sample WiFi.begin call using a password containing a double quote, comma, or backslash, then verify the serialized REQUEST escapes each character so the bridge connects successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100