[Dhirenderchoudhary]

7ASecurity audit of OpenPrinting, finding OCU-01-008, WP1/2, Medium.

CUPS and libppd build a local PPD from the IPP attributes of a remote printer when a driverless queue is created. In the audited CUPS tree, unknown job-presets-supported members were written with ippAttributeString() and cupsFilePrintf(fp, "*%s %s\n", member_name, member_value). ippAttributeString() keeps embedded newlines in text and name values, so a preset value could start a new top-level PPD statement.

Current master already writes an unknown member only when ippValidateAttribute() succeeds and the value is a boolean, an integer, or a keyword. This pull request does not change that generator. It adds the regression test the finding asked for, and runs the test from the existing testppd suite.

The libppd copy of this generator still had the open fallback. That fix is OpenPrinting/libppd#105.

Why

The audited fallback treated an unknown preset member as safe PPD syntax. Master already closed that path. Without a test, a later edit can open it again.

What changed

• testppd --preset-injection calls _ppdCreateFromIPP with a preset that has sides=one-sided, a print-color-mode keyword, and a text value that contains a newline.
• The generated file must contain *Duplex None and *print-color-mode monochrome, and must not contain the injected directive.
• The default testppd run, which make test already executes, calls the same check.

Scope

No change to the PPD generator. ippAttributeString() is unchanged. The libppd generator is the other pull request.

Blast Radius

testppd with no arguments now runs one extra check before the existing PPD tests. A failure there makes the suite fail.

Verification

• ./cups/testppd --preset-injection printed preset text newline is not a new PPD directive: PASS (duplex=1 color=1 injected=0) and exited 0.
• ./cups/testppd (the suite make runs) exited 0, and that same line was PASS.
• Built from this branch on Ubuntu 24.04.

[michaelrsweet]

I'm not sure we need a unit test for this specifically, although we could load different IPP attribute files and generate PPDs to test different aspects of PPD creation. However, without the message catalog stuff we aren't actually testing everything that could "go wrong"...

[Dhirenderchoudhary]

@michaelrsweet Master already skips those text preset values, so this PR is just the test so the newline does not come back.

If you don't want the test, I can close it. The fix is in the libppd PR.

[michaelrsweet]

OK, closing for now but we might circle back...