[FPP 10] fpp-hdmi-cec - compatibility & plugin check

[github-actions]

fpp-hdmi-cec - FPP 10 readiness

Plugin name: HDMI CEC Control +
Repo: https://github.com/focusedonsound/fpp-hdmi-cec
Maintainer: @focusedonsound

📢 FPP's plugin guidelines and submission process have been updated - see the Plugin Guidelines for what's expected of a listed plugin. Adding another plugin? Start at Submit a plugin.

🔄 As part of this new process, in the lead up to each new version release we will create a GitHub issue like this one and ask that you review compatibility of your plugin with the new version and outline any new best practices for plugins. Please review this information and update your plugin accordingly.

🧪 Get your plugin ready for FPP 10

FPP 10.0 beta3 has been released - FPP 10 full release is due shortly. Please test and update your plugin against beta3, available at https://github.com/FalconChristmas/fpp/releases/tag/10.0-beta3.

✅ Compatibility

A versions[] entry already declares FPP 10 support.

Areas of concern / optimisation

• 🛑 Blocker - exec-injection
  • unsanitized request data reaches a shell command (www/action.php:125: shell_exec("bash " . escapeshellarg($script) . " " . escapeshellarg($raw) . " 2>&1");) - an attacker can run arbitrary shell commands as the FPP user.
  • Validate the value against an allow-list before using it, and wrap it in escapeshellarg() (PHP) / shlex.quote() (Python) / pass args as an array to execFile/spawn instead of a shell string (Node) before it reaches exec/system/shell_exec
• ⚠️ Best practice - no-restart-flag
  • registers command type(s) via commands/descriptions.json but doesn't request an fppd restart at every lifecycle point that needs one - install: fpp_install.sh present, no restart/reboot flag; uninstall: fpp_uninstall.sh present, no restart/reboot flag.
  • This plugin's code itself looks fine for FPP 10 - structurally safe to hot-load/unload without a restart there. The flag is still needed because pluginInfo.json's versions[] serves this exact branch/build to FPP majors before 10 too, which have no plugin load/unload feature at all - those installs still need a full fppd restart to pick up install/uninstall.
  • Add source ${FPPDIR}/scripts/common; setSetting restartFlag 1 to each script listed above (creating fpp_install.sh/fpp_uninstall.sh if missing - only fpp_upgrade.sh is optional, and only needs it if you already have one); only drop it once you split off a separate FPP 10+-only branch/sha in versions[]

We know our automated checks don't always get it 100% right. Please fix whatever above does apply first - then, for anything left that doesn't apply or you think deserves an exception, comment /submit with an explanation and a maintainer will take a look.

Once you have updated your plugin, please comment /recheck on this issue and we will automatically scan your plugin and comment the new results here.

Want to sunset this plugin? Request Plugin Removal

[github-actions]

🔄 Forced recheck (remediation sweep) - re-verifying with a real clone+lint pass after a bug let status be set from a metadata-only scan without one.

fpp-hdmi-cec - FPP 10 readiness

Plugin name: HDMI CEC Control +
Repo: https://github.com/focusedonsound/fpp-hdmi-cec
Maintainer: focusedonsound (https://github.com/focusedonsound) (not @-mentioned automatically)

📢 FPP's plugin guidelines and submission process have been updated - see the Plugin Guidelines for what's expected of a listed plugin. Adding another plugin? Start at Submit a plugin.

🔄 As part of this new process, in the lead up to each new version release we will create a GitHub issue like this one and ask that you review compatibility of your plugin with the new version and outline any new best practices for plugins. Please review this information and update your plugin accordingly.

🧪 Get your plugin ready for FPP 10

FPP 10.0 beta3 has been released - FPP 10 full release is due shortly. Please test and update your plugin against beta3, available at https://github.com/FalconChristmas/fpp/releases/tag/10.0-beta3.

✅ Compatibility

A versions[] entry already declares FPP 10 support.

Areas of concern / optimisation

• 🛑 Blocker - exec-injection
  • unsanitized request data reaches a shell command (www/action.php:125: shell_exec("bash " . escapeshellarg($script) . " " . escapeshellarg($raw) . " 2>&1");) - an attacker can run arbitrary shell commands as the FPP user.
  • Validate the value against an allow-list before using it, and wrap it in escapeshellarg() (PHP) / shlex.quote() (Python) / pass args as an array to execFile/spawn instead of a shell string (Node) before it reaches exec/system/shell_exec
• ⚠️ Best practice - no-restart-flag
  • registers command type(s) via commands/descriptions.json but doesn't request an fppd restart at every lifecycle point that needs one - install: fpp_install.sh present, no restart/reboot flag; uninstall: fpp_uninstall.sh present, no restart/reboot flag.
  • This plugin's code itself looks fine for FPP 10 - structurally safe to hot-load/unload without a restart there. The flag is still needed because pluginInfo.json's versions[] serves this exact branch/build to FPP majors before 10 too, which have no plugin load/unload feature at all - those installs still need a full fppd restart to pick up install/uninstall.
  • Add source ${FPPDIR}/scripts/common; setSetting restartFlag 1 to each script listed above (creating fpp_install.sh/fpp_uninstall.sh if missing - only fpp_upgrade.sh is optional, and only needs it if you already have one); only drop it once you split off a separate FPP 10+-only branch/sha in versions[]

We know our automated checks don't always get it 100% right. Please fix whatever above does apply first - then, for anything left that doesn't apply or you think deserves an exception, comment /submit with an explanation and a maintainer will take a look.

Once you have updated your plugin, please comment /recheck on this issue and we will automatically scan your plugin and comment the new results here.

Want to sunset this plugin? Request Plugin Removal

[focusedonsound]

/recheck

[github-actions]

fpp-hdmi-cec - FPP 10 readiness

Plugin name: HDMI CEC Control +
Repo: https://github.com/focusedonsound/fpp-hdmi-cec
Maintainer: focusedonsound (https://github.com/focusedonsound) (not @-mentioned automatically)

📢 FPP's plugin guidelines and submission process have been updated - see the Plugin Guidelines for what's expected of a listed plugin. Adding another plugin? Start at Submit a plugin.

🔄 As part of this new process, in the lead up to each new version release we will create a GitHub issue like this one and ask that you review compatibility of your plugin with the new version and outline any new best practices for plugins. Please review this information and update your plugin accordingly.

🧪 Get your plugin ready for FPP 10

FPP 10.0 beta3 has been released - FPP 10 full release is due shortly. Please test and update your plugin against beta3, available at https://github.com/FalconChristmas/fpp/releases/tag/10.0-beta3.

✅ Compatibility

A versions[] entry already declares FPP 10 support.

Areas of concern / optimisation

• ⚠️ Best practice - hotload-safe-but-spans-pre-hotload-fpp
  • looks structurally safe to hot-load/unload on its own, but pluginInfo.json's versions[] declares a single branch/build whose range starts before FPP 10 (where the plugin load/unload feature doesn't exist at all) and extends into or past it - so this same code also has to support install/uninstall via a full fppd restart for those older FPP installs.
  • Keep restartFlag/rebootFlag set here regardless; only drop it if you split off a separate FPP 10+-only branch/sha in versions[]

We know our automated checks don't always get it 100% right. Please fix whatever above does apply first - then, for anything left that doesn't apply or you think deserves an exception, comment /submit with an explanation and a maintainer will take a look.

Once you have updated your plugin, please comment /recheck on this issue and we will automatically scan your plugin and comment the new results here.

Want to sunset this plugin? Request Plugin Removal

[focusedonsound]

/submit

restartFlag is now set in both fpp_install.sh and fpp_uninstall.sh (commit dc60c27).
We intentionally serve FPP 9 and FPP 10 from the same main branch — the restart flag
handles the pre-hotload FPP 9 case, and FPP 10 gets the benefit of it too. No split
branch is planned.

Also addressed in dc60c27: fixed a shell injection vulnerability in scripts/cec_command.sh
where $COMMAND and $ADAPTER were interpolated directly into a double-quoted bash -c string.
Variables are now passed as positional parameters using a single-quoted template.
Input validation (allow-list regex) was also added to www/action.php as defence-in-depth.

[github-actions]

fpp-hdmi-cec - FPP 10 readiness

Plugin name: HDMI CEC Control +
Repo: https://github.com/focusedonsound/fpp-hdmi-cec
Maintainer: focusedonsound (https://github.com/focusedonsound) (not @-mentioned automatically)

📢 FPP's plugin guidelines and submission process have been updated - see the Plugin Guidelines for what's expected of a listed plugin. Adding another plugin? Start at Submit a plugin.

🔄 As part of this new process, in the lead up to each new version release we will create a GitHub issue like this one and ask that you review compatibility of your plugin with the new version and outline any new best practices for plugins. Please review this information and update your plugin accordingly.

🧪 Get your plugin ready for FPP 10

FPP 10.0 beta3 has been released - FPP 10 full release is due shortly. Please test and update your plugin against beta3, available at https://github.com/FalconChristmas/fpp/releases/tag/10.0-beta3.

✅ Compatibility

A versions[] entry already declares FPP 10 support.

Areas of concern / optimisation

• ⚠️ Best practice - hotload-safe-but-spans-pre-hotload-fpp
  • looks structurally safe to hot-load/unload on its own, but pluginInfo.json's versions[] declares a single branch/build whose range starts before FPP 10 (where the plugin load/unload feature doesn't exist at all) and extends into or past it - so this same code also has to support install/uninstall via a full fppd restart for those older FPP installs.
  • Keep restartFlag/rebootFlag set here regardless; only drop it if you split off a separate FPP 10+-only branch/sha in versions[]

We know our automated checks don't always get it 100% right. Please fix whatever above does apply first - then, for anything left that doesn't apply or you think deserves an exception, comment /submit with an explanation and a maintainer will take a look.

Once you have updated your plugin, please comment /recheck on this issue and we will automatically scan your plugin and comment the new results here.

Want to sunset this plugin? Request Plugin Removal

[github-actions]

Rechecked (B0 best-practice 1 optional 0) - flagged for manual review at the owner's request via /submit. Reason given:

restartFlag is now set in both fpp_install.sh and fpp_uninstall.sh (commit dc60c27). We intentionally serve FPP 9 and FPP 10 from the same main branch — the restart flag handles the pre-hotload FPP 9 case, and FPP 10 gets the benefit of it too. No split branch is planned. Also addressed in dc60c27: fixed a shell injection vulnerability in scripts/cec_command.sh where $COMMAND and $ADAPTER were interpolated directly into a double-quoted bash -c string. Variables are now passed as positional parameters using a single-quoted template. Input validation (allow-list regex) was also added to www/action.php as defence-in-depth.

@dkulp, @darylc, @OnlineDynamic - please take a look.

[github-actions]

👋 Reminder 1 - this tracking issue has had no activity in 8 days. Comment /recheck after updating your plugin, or /submit if you disagree with the findings.

Want to sunset this plugin instead? Submit a removal request at https://falconchristmas.github.io/fpp-data/submit_remove_plugin/

[focusedonsound]

/recheck