[PATCH iproute2 03/11] ss: escape names chosen by the socket owner

[Stephen Hemminger <stephen@networkplumber.org>]

Unix socket names and process names are set by whoever owns the
socket and can contain newlines, control characters or a double
quote. They reached the output unchanged, so a local user could
split a row, insert a fake one, or, since -p prints the process name
inside double quotes, make a bogus pid appear:

  users:(("x",pid=1,fd=3",pid=268,fd=3))

Escape them with escape_str(), and replace the double quote
there like the other non-printing characters. Set LC_CTYPE from the
environment so UTF-8 names stay intact instead of having every
non-ASCII byte replaced.

Reported-by: Anthropic OSS scanner (ANT-2026-4X7MF603)
Reported-by: Anthropic OSS scanner (ANT-2026-CAAB6GZ9)
Assisted-by: Claude:claude-opus-5
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/escape.c |  7 ++++---
 misc/ss.c    | 13 +++++++++++--
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/lib/escape.c b/lib/escape.c
index b110f61b..e4646bc5 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -50,7 +50,7 @@ static const char UTF_tab[] = {
 
 static const unsigned char ESC_tab[] = {
 	"@..............................." // 0x00 - 0x1F
-	"||||||||||||||||||||||||||||||||" // 0x20 - 0x3F
+	"||?|||||||||||||||||||||||||||||" // 0x20 - 0x3F
 	"||||||||||||||||||||||||||||||||" // 0x40 - 0x5f
 	"|||||||||||||||||||||||||||||||." // 0x60 - 0x7F
 	"????????????????????????????????" // 0x80 - 0x9F
@@ -83,8 +83,9 @@ static void esc_ctl(unsigned char *str, int len)
 			esc_all(str);
 			return;
 		}
-		// and eliminate those non-printing control characters
-		if (*str < 0x20 || *str == 0x7f)
+		// and eliminate those non-printing control characters,
+		// plus double quote which callers use as a delimiter
+		if (*str < 0x20 || *str == 0x7f || *str == '"')
 			*str = '?';
 		str += n;
 		i += n;
diff --git a/misc/ss.c b/misc/ss.c
index b93df60f..4462a479 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -25,6 +25,7 @@
 #include <limits.h>
 #include <stdarg.h>
 #include <ctype.h>
+#include <locale.h>
 
 #include "ss_util.h"
 #include "utils.h"
@@ -4075,10 +4076,13 @@ static bool unix_type_skip(struct sockstat *s, struct filter *f)
 static void unix_stats_print(struct sockstat *s, struct filter *f)
 {
 	char port_name[30] = {};
+	char name[128];
 
 	sock_state_print(s);
 
-	sock_addr_print(s->name ?: "*", " ",
+	/* name is chosen by whoever bound the socket, may contain newlines */
+	escape_str(name, s->name ?: "*", sizeof(name));
+	sock_addr_print(name, " ",
 			uint_to_str(s->lport, port_name), NULL);
 	sock_addr_print(s->peer_name ?: "*", " ",
 			uint_to_str(s->rport, port_name), NULL);
@@ -4611,6 +4615,7 @@ static int netlink_show_one(struct filter *f,
 	if (pid == -1) {
 		procname[0] = '*';
 	} else if (!numeric) {
+		char task[16];
 		int done = 0;
 
 		if (!pid) {
@@ -4618,7 +4623,8 @@ static int netlink_show_one(struct filter *f,
 			strncpy(procname, "kernel", 7);
 		} else if (pid > 0) {
 			if (get_task_name(getenv("PROC_ROOT"), pid,
-					  procname, sizeof(procname)) == 0) {
+					  task, sizeof(task)) == 0) {
+				escape_str(procname, task, sizeof(procname));
 				snprintf(procname + strlen(procname),
 					 sizeof(procname) - strlen(procname),
 					 "/%d", pid);
@@ -5357,6 +5363,9 @@ int main(int argc, char *argv[])
 	int ch;
 	int state_filter = 0;
 
+	/* needed by escape_str() to pass through UTF-8 names */
+	setlocale(LC_CTYPE, "");
+
 	while ((ch = getopt_long(argc, argv,
 				 "halBetuwxnro460spTbEf:mMiA:D:F:vVzZN:KHQSO",
 				 long_opts, NULL)) != EOF) {
-- 
2.53.0