Question about RCE via IP/MAC field

[invario]

I have a question about this, and maybe I'm missing something.

GHSA-6mc7-6948-w5h4

An UpSnap user that has permission to edit a device means they have permission to set the wake and shutdown commands. And if that's the case, why does sanitizing the IP and MAC address make a difference? Anyone that wanted to do RCE wouldn't need to inject anything into the IP or MAC. The wake/shutdown command fields are literally executing the user's commands, no?

[seriousm4x]

Yes, that's correct. While it's not really a big security issue, I just like to have code that works as expected. Yes, I could just ignore it but it might lead to risks in a year to two. Who knows if the permissions system will change over the years.