fix: validate OTA firmware paths to prevent traversal

payload.hex.file_name on bridge/request/device/ota_update/{update,
schedule} flowed unvalidated into join(baseDir, fileName), letting
MQTT clients write attacker-controlled firmware bytes to arbitrary
paths. Resolve the target via the shared resolveSafeChildPath helper
and reject anything that isn't a direct child of <data>/ota. Wrap the
writeFirmwareHexToDataDir calls in try/catch so the validation throw
surfaces as an error response on the bridge topic instead of crashing
the handler.

Replace the unschedule rmSync prefix check with the same helper.
A string-based startsWith with path.sep is bypassable by storing a
traversed payload.url ("<data>/ota/../../etc/passwd") at schedule
time: the prefix matches but the syscall resolves outside the OTA
dir. resolveSafeChildPath normalizes via path.resolve and rejects
anything whose parent isn't <data>/ota.

Includes regression tests for ".." / "." / "../escape.hex" file_name
on update + schedule, and a traversal-url unschedule case.

Author: filips

lib/extension/otaUpdate.ts

@@ -31,18 +31,13 @@ export interface UpdatePayload {
  * Write to `dataDir` and return created path
  */
 function writeFirmwareHexToDataDir(hex: string, fileName: string | undefined, deviceIeee: string): string {
-    if (!fileName) {
-        fileName = `${deviceIeee}_${Date.now()}`;
-    }
-
     const baseDir = dataDir.joinPath("ota");
+    const filePath = fileName ? utils.resolveSafeChildPath(baseDir, fileName) : join(baseDir, `${deviceIeee}_${Date.now()}`);
 
     if (!existsSync(baseDir)) {
         mkdirSync(baseDir, {recursive: true});
     }
 
-    const filePath = join(baseDir, fileName);
-
     writeFileSync(filePath, Buffer.from(hex, "hex"));
 
     return filePath;
@@ -340,8 +335,13 @@ export default class OTAUpdate extends Extension {
                         if (payload.hex) {
                             assert(payload.hex.data);
 
-                            // write to `dataDir` and pass created path as source URL
-                            source.url = writeFirmwareHexToDataDir(payload.hex.data, payload.hex.file_name, device.ieeeAddr);
+                            try {
+                                // write to `dataDir` and pass created path as source URL
+                                source.url = writeFirmwareHexToDataDir(payload.hex.data, payload.hex.file_name, device.ieeeAddr);
+                            } catch (e) {
+                                error = (e as Error).message;
+                                break;
+                            }
                         } else if (payload.url) {
                             source.url = payload.url;
                         } else if (!device.definition?.ota) {
@@ -411,8 +411,13 @@ export default class OTAUpdate extends Extension {
                         if (payload.hex) {
                             assert(payload.hex.data);
 
-                            // write to `dataDir` and pass created path as source URL
-                            source.url = writeFirmwareHexToDataDir(payload.hex.data, payload.hex.file_name, device.ieeeAddr);
+                            try {
+                                // write to `dataDir` and pass created path as source URL
+                                source.url = writeFirmwareHexToDataDir(payload.hex.data, payload.hex.file_name, device.ieeeAddr);
+                            } catch (e) {
+                                error = (e as Error).message;
+                                break;
+                            }
                         } else if (payload.url) {
                             source.url = payload.url;
                         } else if (!device.definition?.ota) {
@@ -435,8 +440,14 @@ export default class OTAUpdate extends Extension {
                 }
 
                 case "unschedule": {
-                    if (device.zh.scheduledOta?.url?.startsWith(dataDir.joinPath("ota"))) {
-                        rmSync(device.zh.scheduledOta.url, {force: true});
+                    const url = device.zh.scheduledOta?.url;
+
+                    if (url) {
+                        try {
+                            rmSync(utils.resolveSafeChildPath(dataDir.joinPath("ota"), url), {force: true});
+                        } catch {
+                            // not a safe child of OTA dir (remote URL or traversal) — skip
+                        }
                     }
 
                     device.zh.unscheduleOta();

test/extensions/otaUpdate.test.ts

@@ -8,7 +8,7 @@ import {flushPromises} from "../mocks/utils";
 import {devices, events as mockZHEvents} from "../mocks/zigbeeHerdsman";
 
 import {join} from "node:path";
-import {existsSync, readFileSync, rmSync} from "node:fs";
+import {existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync} from "node:fs";
 import stringify from "json-stable-stringify-without-jsonify";
 import {Controller} from "../../lib/controller";
 import OTAUpdate from "../../lib/extension/otaUpdate";
@@ -409,6 +409,31 @@ describe("Extension: OTAUpdate", () => {
         expect(readFileSync(saveFilePath)).toStrictEqual(Buffer.from([0x01, 0x02, 0x03]));
     });
 
+    it.each([
+        ["..", "update"],
+        [".", "update"],
+        ["../escape.hex", "update"],
+        ["..", "schedule"],
+        ["../escape.hex", "schedule"],
+    ])("rejects %s file_name on %s", async (badName, op) => {
+        const otaDir = join(data.mockDir, "ota");
+        const before = existsSync(otaDir) ? readdirSync(otaDir) : [];
+
+        mockMQTTEvents.message(
+            `zigbee2mqtt/bridge/request/device/ota_update/${op}`,
+            stringify({id: "bulb", hex: {data: "010203", file_name: badName}}),
+        );
+        await flushPromises();
+
+        expect(mockMQTTPublishAsync).toHaveBeenCalledWith(
+            `zigbee2mqtt/bridge/response/device/ota_update/${op}`,
+            expect.stringContaining(`Invalid file name '${badName}'`),
+            {},
+        );
+        const after = existsSync(otaDir) ? readdirSync(otaDir) : [];
+        expect(after).toStrictEqual(before);
+    });
+
     it("updates with override data settings", async () => {
         devices.bulb.updateOta.mockImplementationOnce(
             async (_source, _requestPayload, _requestTsn, _extraMetas, _onProgress, _dataSettings, _endpoint) => {
@@ -1212,6 +1237,27 @@ describe("Extension: OTAUpdate", () => {
         expect(devices.bulb.scheduledOta).toStrictEqual(undefined);
     });
 
+    it("does not rmSync outside ota dir on unschedule with traversal url", async () => {
+        const otaDir = join(data.mockDir, "ota");
+        mkdirSync(otaDir, {recursive: true});
+        const sentinelFile = join(data.mockDir, "canary.txt");
+        writeFileSync(sentinelFile, "do-not-delete");
+
+        // schedule with a payload.url that escapes the ota dir via traversal
+        const traversalUrl = join(otaDir, "..", "canary.txt");
+        mockMQTTEvents.message("zigbee2mqtt/bridge/request/device/ota_update/schedule", stringify({id: "bulb", url: traversalUrl}));
+        await flushPromises();
+        expect(devices.bulb.scheduledOta).toStrictEqual({url: traversalUrl, downgrade: false});
+
+        mockMQTTEvents.message("zigbee2mqtt/bridge/request/device/ota_update/unschedule", stringify({id: "bulb"}));
+        await flushPromises();
+
+        expect(existsSync(sentinelFile)).toStrictEqual(true);
+        expect(devices.bulb.scheduledOta).toStrictEqual(undefined);
+
+        rmSync(sentinelFile);
+    });
+
     it("responds with NO_IMAGE_AVAILABLE when not supporting OTA", async () => {
         const device = devices.HGZB04D;
         const data = {imageType: 12382};