v2.10.0 Fixes & Enhancements

.github/workflows/build.yml

@@ -57,8 +57,6 @@ jobs:
     strategy:
       matrix:
         include:
-          - PFSENSE_VERSION: pfSense-2.8.0-RELEASE
-            FREEBSD_ID: freebsd15
           - PFSENSE_VERSION: pfSense-2.8.1-RELEASE
             FREEBSD_ID: freebsd15
     steps:
@@ -107,8 +105,6 @@ jobs:
     strategy:
       matrix:
         include:
-          - PFSENSE_VERSION: pfSense-2.8.0-RELEASE
-            FREEBSD_ID: freebsd15
           - PFSENSE_VERSION: pfSense-2.8.1-RELEASE
             FREEBSD_ID: freebsd15
     steps:
@@ -136,8 +132,6 @@ jobs:
     strategy:
       matrix:
         include:
-          - PFSENSE_VERSION: pfSense-2.8.0-RELEASE
-            FREEBSD_ID: freebsd15
           - PFSENSE_VERSION: pfSense-2.8.1-RELEASE
             FREEBSD_ID: freebsd15
 

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Auth/BasicAuth.inc

@@ -28,8 +28,8 @@ class BasicAuth extends Auth {
      */
     public function _authenticate(): bool {
         # Obtain the username and password from the client via Basic authentication
-        $this->username = $_SERVER['PHP_AUTH_USER'] ?: '';
-        $password = $_SERVER['PHP_AUTH_PW'] ?: '';
+        $this->username = $_SERVER['PHP_AUTH_USER'] ?? '';
+        $password = $_SERVER['PHP_AUTH_PW'] ?? '';
 
         # Authenticate against the local user database and return the result
         return (bool) authenticate_user($this->username, $password);
@@ -39,7 +39,7 @@ class BasicAuth extends Auth {
      * Checks if the remote client is requesting BasicAuth by checking for the necessary headers.
      */
     public function is_requested(): bool {
-        return $_SERVER['PHP_AUTH_USER'] or $_SERVER['PHP_AUTH_PW'];
+        return $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'];
     }
 
     /**

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Auth/JWTAuth.inc

@@ -28,12 +28,20 @@ class JWTAuth extends Auth {
         $decoded_jwt = RESTAPIJWT::decode($this->get_auth_key(identifier: 'bearer'));
 
         # Check that the JWT from our Authorization header is valid
-        if ($decoded_jwt) {
+        if ($decoded_jwt and !empty($decoded_jwt['data'])) {
             # Set the username of the authenticating client embedded in the decoded JWT data payload.
             $this->username = $decoded_jwt['data'];
             return true;
         }
 
         return false;
     }
+
+    /**
+     * Checks if the client is requesting JWT authentication by detecting an Authorization: Bearer
+     * header. Credential validation is intentionally deferred to _authenticate().
+     */
+    public function is_requested(): bool {
+        return !empty($this->get_auth_key(identifier: 'bearer'));
+    }
 }

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Auth/KeyAuth.inc

@@ -21,6 +21,14 @@ class KeyAuth extends Auth {
      */
     public array $security_scheme = ['type' => 'apiKey', 'in' => 'header', 'name' => 'x-api-key'];
 
+    /**
+     * Checks if the client is requesting key authentication by detecting the x-api-key header.
+     * Credential validation is intentionally deferred to _authenticate().
+     */
+    public function is_requested(): bool {
+        return !empty($_SERVER['HTTP_X_API_KEY'] ?? '');
+    }
+
     /**
      * Performs REST API key authentication and obtains the username of the user who owns the provided key.
      * @return bool Returns true if match for this client's key found a match stored in config, returns false

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Auth.inc

@@ -195,6 +195,11 @@ class Auth {
      * @return bool `true` if the user is disabled, `false` if it is not.
      */
     public static function is_user_enabled(string $username): bool {
+        # If username is somehow empty, consider them disabled
+        if (empty($username)) {
+            return false;
+        }
+
         return User::query(name: $username, disabled: false)->exists();
     }
 

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Command.inc

@@ -33,29 +33,119 @@ class Command {
      */
     public bool $trim_whitespace = false;
 
+    /**
+     * @var bool $escape Whether to automatically escape each token in the command string before execution.
+     * Defaults to true. Set to false only when the caller has already performed its own escaping or when
+     * shell features such as pipes, redirects, or glob expansion are intentionally required.
+     */
+    public bool $escape = true;
+
+    /**
+     * @var string $pipe An optional command string to pipe the output of $command into. When set, the shell
+     * pipeline `<command> | <pipe>` is constructed. The pipe command is escaped independently according to
+     * $escape_pipe. Use this instead of embedding `|` in the raw $command string, which would be neutralised
+     * by auto-escaping.
+     */
+    public string $pipe = '';
+
+    /**
+     * @var bool $escape_pipe Whether to automatically escape the tokens of the $pipe command string. Defaults
+     * to true. Set to false when the pipe command contains shell features (e.g. `grep "some pattern"`) that
+     * must be passed verbatim.
+     */
+    public bool $escape_pipe = true;
+
     /**
      * Defines the Command object including the shell command to execute and optional modifiers. Note: By default,
      * the command output will redirect stderr to stdout so error message will be included in the output.
      * @param string $command The shell command to execute.
      * @param bool $trim_whitespace Remove excessive whitespace from the command output.
      * @param string $redirect An optional shell redirect to append to the end of the $command.
+     * @param bool $escape Automatically escape each token in the command string before execution. Defaults to
+     * true. Set to false only when the caller has already performed its own escaping or when shell features
+     * such as pipes, redirects, or glob expansion are intentionally required.
+     * @param string $pipe An optional command string to pipe the output of $command into. Escaped independently
+     * according to $escape_pipe.
+     * @param bool $escape_pipe Whether to automatically escape the tokens of the $pipe command. Defaults to true.
      * @return Command Returns this object containing the results of the executed command. Note: the object returned
      * cannot be used to initiate new commands. A new Command object should be created for any additional commands.
      */
-    public function __construct(string $command, bool $trim_whitespace = false, string $redirect = '2>&1') {
+    public function __construct(
+        string $command,
+        bool $trim_whitespace = false,
+        string $redirect = '2>&1',
+        bool $escape = true,
+        string $pipe = '',
+        bool $escape_pipe = true,
+    ) {
         $this->command = $command;
         $this->trim_whitespace = $trim_whitespace;
         $this->redirect = $redirect;
+        $this->escape = $escape;
+        $this->pipe = $pipe;
+        $this->escape_pipe = $escape_pipe;
         $this->run_command();
         return $this;
     }
 
+    /**
+     * Parses a raw command string into an array of argument tokens, respecting single- and double-quoted
+     * substrings so that spaces inside quotes are not treated as delimiters. Surrounding quotes are stripped
+     * from each token so that the value can be re-escaped uniformly by escape_command().
+     * @param string $command The raw command string to tokenize.
+     * @return array<string> An ordered list of unquoted token strings.
+     */
+    public static function tokenize_command(string $command): array {
+        $tokens = [];
+
+        # Match single-quoted strings, double-quoted strings, or unquoted non-whitespace sequences
+        preg_match_all("/'[^']*'|\"[^\"]*\"|[^\s]+/", $command, $matches);
+
+        foreach ($matches[0] as $token) {
+            # Strip surrounding single quotes
+            if (str_starts_with($token, "'") && str_ends_with($token, "'")) {
+                $tokens[] = substr($token, 1, -1);
+            }
+            # Strip surrounding double quotes
+            elseif (str_starts_with($token, '"') && str_ends_with($token, '"')) {
+                $tokens[] = substr($token, 1, -1);
+            }
+            # Unquoted token — use as-is
+            else {
+                $tokens[] = $token;
+            }
+        }
+
+        return $tokens;
+    }
+
+    /**
+     * Escapes a raw command string by tokenizing it (respecting quoted substrings) and applying
+     * escapeshellarg() to every token before re-joining with spaces. This prevents command injection
+     * regardless of whether the original string contained pre-quoted or unquoted arguments.
+     * @param string $command The raw command string to escape.
+     * @return string The fully escaped command string ready for exec().
+     */
+    public static function escape_command(string $command): string {
+        $tokens = self::tokenize_command($command);
+        $escaped = array_map('escapeshellarg', $tokens);
+        return implode(' ', $escaped);
+    }
+
     /**
      * Executes the assigned $command. The $output and $result_code properties will be set after running
      * this method.
      */
     private function run_command(): void {
-        exec(command: "$this->command $this->redirect", output: $raw_output, result_code: $this->result_code);
+        $safe_command = $this->escape ? self::escape_command($this->command) : $this->command;
+
+        # Append a pipe stage when one is specified, escaping it independently
+        if ($this->pipe !== '') {
+            $safe_pipe = $this->escape_pipe ? self::escape_command($this->pipe) : $this->pipe;
+            $safe_command = "$safe_command | $safe_pipe";
+        }
+
+        exec(command: "$safe_command $this->redirect", output: $raw_output, result_code: $this->result_code);
         $this->output = implode(PHP_EOL, $raw_output);
 
         # Normalize output's whitespace if requested

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Endpoint.inc

@@ -1299,7 +1299,7 @@ class Endpoint {
         }
 
         # Otherwise, delete a single object
-        $this->model->from_representation(data: $this->request_data);
+        $this->model->from_representation(id: $this->request_data['id'], parent_id: $this->request_data['parent_id']);
         return $this->model->delete(apply: $this->request_data['apply'] === true);
     }
 

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/TestCase.inc

@@ -130,27 +130,6 @@ class TestCase {
         }
     }
 
-    /**
-     * Runs a shell command and returns its output and return code.
-     * @param string $command The command to execute.
-     * @param bool $trim_whitespace Remove excess whitespace from the command output. This is sometimes helpful when
-     * the output of commands that do not have consistent whitespace formatting.
-     * @return array An array where the `output` key contains the commands output and the `result_code` key contains the
-     * resulting result code of the command.
-     */
-    function run_command(string $command, bool $trim_whitespace = false): array {
-        $results = ['output' => null, 'code' => null];
-        exec(command: "$command 2>/dev/null", output: $results['output'], result_code: $results['result_code']);
-        $results['output'] = implode(PHP_EOL, $results['output']);
-
-        # Normalize output's whitespace if requested
-        if ($trim_whitespace) {
-            $results['output'] = preg_replace('/\s+/', ' ', $results['output']);
-        }
-
-        return $results;
-    }
-
     /**
      * Sets up the test case before tests are run. This can be overridden by your TestCase to setup shared resources
      * required for your tests.

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Dispatchers/ACMECertificateIssueDispatcher.inc

@@ -2,6 +2,7 @@
 
 namespace RESTAPI\Dispatchers;
 
+use RESTAPI\Core\Command;
 use RESTAPI\Core\Dispatcher;
 use RESTAPI\Responses\ServerError;
 
@@ -37,14 +38,23 @@ class ACMECertificateIssueDispatcher extends Dispatcher {
             result_log: '',
         );
 
-        # pfSense prints the output of the acme.sh instead of returning it, start output buffering to capture it
-        ob_start();
+        # Record the current byte size of the acme.sh issue log before issuance so we can
+        # extract only the new content appended during this run.
+        $log_file = "/tmp/acme/{$arguments['certificate']}/acme_issuecert.log";
+        $pre_size = file_exists($log_file) ? filesize($log_file) : 0;
 
         # Issue the ACME certificate
         \pfsense_pkg\acme\issue_certificate(id: $arguments['certificate'], force: true, renew: false);
 
-        # Log the results of the ACME certificate issue
-        $result = ob_get_clean();
+        # Extract only the bytes appended to the log since before the issuance started.
+        # tail -c +N outputs from byte N onward (1-indexed), so +($pre_size+1) skips
+        # all pre-existing content and returns only what was written during this run.
+        $start_byte = $pre_size + 1;
+        if (file_exists($log_file) && filesize($log_file) >= $start_byte) {
+            $result = (new Command("/usr/bin/tail -c +$start_byte $log_file"))->output;
+        } else {
+            $result = '';
+        }
 
         # Replace the issuance result file
         $this->set_issuance_result(
@@ -55,7 +65,7 @@ class ACMECertificateIssueDispatcher extends Dispatcher {
         );
 
         # Wait a bit to ensure the issue log is written before proceeding
-        sleep(1);
+        sleep(5);
     }
 
     /**

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Dispatchers/ACMECertificateRenewDispatcher.inc

@@ -2,6 +2,7 @@
 
 namespace RESTAPI\Dispatchers;
 
+use RESTAPI\Core\Command;
 use RESTAPI\Core\Dispatcher;
 use RESTAPI\Responses\ServerError;
 
@@ -37,14 +38,23 @@ class ACMECertificateRenewDispatcher extends Dispatcher {
             result_log: '',
         );
 
-        # pfSense prints the output of the acme.sh instead of returning it, start output buffering to capture it
-        ob_start();
+        # Record the current byte size of the acme issue log before renewal so we can
+        # extract only the new content appended during this run.
+        $log_file = "/tmp/acme/{$arguments['certificate']}/acme_issuecert.log";
+        $pre_size = file_exists($log_file) ? filesize($log_file) : 0;
 
-        # Issue the ACME certificate
+        # Renew the ACME certificate
         \pfsense_pkg\acme\issue_certificate(id: $arguments['certificate'], force: true, renew: true);
 
-        # Log the results of the ACME certificate renewal
-        $result = ob_get_clean();
+        # Extract only the bytes appended to the log since before the renewal started.
+        # tail -c +N outputs from byte N onward (1-indexed), so +($pre_size+1) skips
+        # all pre-existing content and returns only what was written during this run.
+        $start_byte = $pre_size + 1;
+        if (file_exists($log_file) && filesize($log_file) >= $start_byte) {
+            $result = (new Command("/usr/bin/tail -c +$start_byte $log_file"))->output;
+        } else {
+            $result = '';
+        }
 
         # Replace the renewal result file
         $this->set_renewal_result(

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Fields/StringField.inc

@@ -123,7 +123,8 @@ class StringField extends Field {
             internal_namespace: $internal_namespace,
             referenced_by: $referenced_by,
             conditions: $conditions,
-            validators: $validators + [
+            validators: [
+                ...$validators,
                 new RESTAPI\Validators\LengthValidator(minimum: $minimum_length, maximum: $maximum_length),
             ],
             help_text: $help_text,

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/Certificate.inc

@@ -4,9 +4,9 @@ namespace RESTAPI\Models;
 
 use RESTAPI\Core\Model;
 use RESTAPI\Fields\Base64Field;
-use RESTAPI\Fields\StringField;
 use RESTAPI\Fields\DateTimeField;
 use RESTAPI\Fields\IntegerField;
+use RESTAPI\Fields\StringField;
 use RESTAPI\Fields\UIDField;
 use RESTAPI\Responses\ForbiddenError;
 use RESTAPI\Responses\ValidationError;

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/CertificateAuthority.inc

@@ -5,7 +5,6 @@ namespace RESTAPI\Models;
 use RESTAPI\Core\Model;
 use RESTAPI\Fields\Base64Field;
 use RESTAPI\Fields\BooleanField;
-use RESTAPI\Fields\ForeignModelField;
 use RESTAPI\Fields\IntegerField;
 use RESTAPI\Fields\StringField;
 use RESTAPI\Fields\UIDField;

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/CommandPrompt.inc

@@ -43,7 +43,7 @@ class CommandPrompt extends Model {
      * Execute the requested command and populate the output and result code.
      */
     public function _create(): void {
-        $cmd = new Command($this->command->value);
+        $cmd = new Command($this->command->value, escape: false);
         $this->output->value = $cmd->output;
         $this->result_code->value = $cmd->result_code;
     }

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/Enum.inc

@@ -3,9 +3,7 @@
 namespace RESTAPI\Models;
 
 use RESTAPI;
-use RESTAPI\Core\Command;
 use RESTAPI\Core\Model;
-use RESTAPI\Fields\BooleanField;
 use RESTAPI\Fields\ForeignModelField;
 use RESTAPI\Fields\ObjectField;
 use RESTAPI\Fields\StringField;

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/IPsecChildSAStatus.inc

@@ -5,8 +5,6 @@ namespace RESTAPI\Models;
 use RESTAPI\Core\Model;
 use RESTAPI\Fields\BooleanField;
 use RESTAPI\Fields\IntegerField;
-use RESTAPI\Fields\NestedModelField;
-use RESTAPI\Fields\PortField;
 use RESTAPI\Fields\StringField;
 
 /**