CUPS passes illegal chartacters from PPD file to IPP attributes

[tillkamppeter]

Original report to Ubuntu:

https://bugs.launchpad.net/ubuntu/+source/cups/+bug/2089231

The user has several printers on CUPS servers. One of the printers disappeared when IPP attributes from the response to a get-printer-attributes IPP request got checked for illegal characters to prevent the recently reported RCE vulnerability in cups-browsed.

The printer in questions is the KONICA MINOLTA C658 PostScript printer. Its PPD file (attached) contains parentheses in the machine-readable/command line names of media types:

*MediaType Thick1(2nd)/Karton 1(Seite2): "<< /KMMediaType (Plain) /KMMediaColor (None) /KMMediaWeight (Thick) /MediaTabType (None) /MediaPreprinted true /MediaPrepunched false >>
 /KMOptions /ProcSet findresource /setKMoptions get exec"
*End

Probably this is already not correct for PPD files (but cupstestppd does not complain about it), but when CUPS generates the printer IPP attributes to answer a client's get-printer-attributes IPP request it should remove the parentheses (use thick-1-2nd for example), as otherwise a client with all the recent security updates would reject the printer due to the illegal characters in the IPP attributes.

To solve this problem, not only parentheses should be filtered but also any other illegal characters. AFAIK only letters, numbers and hyphens are allowed (and letters have to be converted to lowercase).

[tillkamppeter]

PPD file of the KONICA MINOLTA C658 PostScript:
KONICA_MINOLTA-C658_Series_PS.ppd.txt

[SpaciousCoder78]

Can you assign this issue to me? I'm willing to work on it

[SpaciousCoder78]

I'm taking up the issue and will begin my work soon.