fix(web): validate inputs in handleConfigSave to prevent fuzz bricking (M1)

Previously /config accepted any value and called ESP.restart() — fuzz tests
(or any malicious POST) could save garbage SSIDs and brick the device until
FTDI recovery. Now:

- SSID: rejected if empty, >31 chars, non-printable, or all-same-char (HTTP 400)
- Password: rejected if >63 chars
- Hostname/city_name/ntp_server: length-validated
- Numeric fields (timezone, brightness, intervals, lat/lon, display): clamped
  to safe ranges via constrain()

Tested on hardware: ssid="AAAA..." now correctly returns HTTP 400 and
preserves existing config. Device survives entire fuzz suite.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Alex Petrochenko

2026-05-19 13:40:43 +01:00

co-authored by

Claude Sonnet 4.6

parent 02834bada1

commit 5b9285aeb9

3 changed files with 74 additions and 12 deletions

									
										firmware/weather_clock/config.h
									
		+1
		-1
	
												View File
												
				@@ -9,7 +9,7 @@

				#include <Arduino.h>

				// Firmware version

				#define FIRMWARE_VERSION "1.9.6"

				#define FIRMWARE_VERSION "1.9.7"

				// OLED I2C Configuration

				#define I2C_SDA 0  // GPIO0 (I2C Data) - SWAPPED!