From 57a540d3d74062fc0d5e01f0bc1874b215b8bb58 Mon Sep 17 00:00:00 2001 From: George Joseph Date: Thu, 21 May 2026 07:55:01 -0600 Subject: [PATCH] ARI: Make ARI applications respect live_dangerously. DeveloperNote: ARI applications can no longer call "dangerous" dialplan functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without enabling "live_dangerously" in asterisk.conf. Resolves: #GHSA-vrfp-mg3q-3959 --- include/asterisk/stasis_app.h | 5 +++++ res/stasis/control.c | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/include/asterisk/stasis_app.h b/include/asterisk/stasis_app.h index d522a1ff68..ada11120dd 100644 --- a/include/asterisk/stasis_app.h +++ b/include/asterisk/stasis_app.h @@ -631,6 +631,11 @@ int stasis_app_control_answer(struct stasis_app_control *control); * \param variable The name of the variable * \param value The value to set the variable to * + * \note The thread that actually does the set will have the inhibit_escalations + * flag set before the call to pbx_builtin_setvar_helper to prevent dangerous + * dialplan function execution from ARI. The flag will be reset to its original + * state when pbx_builtin_setvar_helper returns. + * * \return 0 for success. * \return -1 for error. */ diff --git a/res/stasis/control.c b/res/stasis/control.c index ae99f9496e..7476049c68 100644 --- a/res/stasis/control.c +++ b/res/stasis/control.c @@ -745,12 +745,22 @@ static int app_control_set_channel_var(struct stasis_app_control *control, struct ast_channel *chan, void *data) { struct chanvar *var = data; + /* + * Save the current inhibit state then enable it. + */ + int inhibited = ast_thread_inhibit_escalations_swap(1); if (ast_channel_set_ari_var_reportable(control->channel, var->name, var->report_events)) { return -1; } pbx_builtin_setvar_helper(control->channel, var->name, var->value); + /* + * Re-enable it if it was originally enabled. + */ + if (inhibited > 0) { + ast_thread_inhibit_escalations(); + } return 0; }