Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion emhttp/plugins/dynamix/DashStats.page
Original file line number Diff line number Diff line change
Expand Up @@ -804,10 +804,14 @@ switch ($themeHelper->getThemeName()) { // $themeHelper set in DefaultPageLayout
<?
$label = $value = [];
$i = 0;
// optional custom fan names, indexed in the same order as `sensors -uA`
$fan_names_file = '/boot/config/plugins/dynamix/fan_names.json';
$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$label[$i][] = "<span{$class}>"._('FAN')." ".($fan+1)."</span>";
$fan_label = ($fan_names[$fan] ?? '') !== '' ? htmlspecialchars($fan_names[$fan]) : _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
Comment on lines +809 to +823

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate custom fan-name type before escaping.

At Line 813, non-string JSON values can pass the !== '' check and then reach htmlspecialchars(...), which can trigger runtime errors and break Airflow tile rendering for malformed fan_names.json.

Suggested fix
-$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
+$fan_names = file_exists($fan_names_file) ? json_decode(file_get_contents($fan_names_file), true) : [];
+if (!is_array($fan_names)) $fan_names = [];
 ...
-    $fan_label = ($fan_names[$fan] ?? '') !== '' ? htmlspecialchars($fan_names[$fan]) : _('FAN')." ".($fan+1);
+    $custom_name = $fan_names[$fan] ?? null;
+    $fan_label = (is_string($custom_name) && trim($custom_name) !== '')
+      ? htmlspecialchars($custom_name)
+      : _('FAN')." ".($fan+1);
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$label[$i][] = "<span{$class}>"._('FAN')." ".($fan+1)."</span>";
$fan_label = ($fan_names[$fan] ?? '') !== '' ? htmlspecialchars($fan_names[$fan]) : _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
$fan_names = file_exists($fan_names_file) ? json_decode(file_get_contents($fan_names_file), true) : [];
if (!is_array($fan_names)) $fan_names = [];
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$custom_name = $fan_names[$fan] ?? null;
$fan_label = (is_string($custom_name) && trim($custom_name) !== '')
? htmlspecialchars($custom_name)
: _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@emhttp/plugins/dynamix/DashStats.page` around lines 809 - 814, The code uses
$fan_names[$fan] without ensuring it's a string before calling htmlspecialchars,
which can cause runtime errors for non-string JSON values; update the logic
around $fan_label in the loop (the handling that reads $fan_names_file,
$fan_names and assigns $fan_label) to first validate the value is a non-empty
string (e.g. is_string($fan_names[$fan]) && $fan_names[$fan] !== '') and only
then call htmlspecialchars on it, otherwise fall back to the default _('FAN')."
".($fan+1); ensure the check replaces the current !== '' test so malformed
fan_names.json entries won't reach htmlspecialchars.

}
$i = 0;
for ($fan=0; $fan<$fans; $fan++) {
Expand Down