Virtual media should always create pipe

This is an attempt to fix the issue reported on discord [1]

Tested: This will break some folks downstream code, because we're
changing the prototype here of the method call.  I try to avoid that
where we can, but this interface isn't really viable as it is.

[1] https://discord.com/channels/775381525260664832/855566794994221117/1338885294417510444

Change-Id: I72aa7f7fe65432019d280477dc32559bb840dfb1
Signed-off-by: Ed Tanous <etanous@nvidia.com>

1 files changed, 40 insertions, 31 deletions

diff --git a/redfish-core/lib/virtual_media.hpp b/redfish-core/lib/virtual_media.hpp
index fca6bbac93..f67af8e9dd 100644
--- a/redfish-core/lib/virtual_media.hpp
+++ b/redfish-core/lib/virtual_media.hpp
@@ -26,6 +26,7 @@
 #include <sdbusplus/message/native_types.hpp>
 
 #include <cstddef>
+#include <cstdint>
 #include <filesystem>
 #include <functional>
 #include <memory>
@@ -454,46 +455,54 @@ inline void doMountVmLegacy(const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
                             const std::string& imageUrl, bool rw,
                             std::string&& userName, std::string&& password)
 {
-    int fd = -1;
-    std::shared_ptr<CredentialsPipe> secretPipe;
-    if (!userName.empty() || !password.empty())
+    if (userName.contains('\0'))
     {
-        // Payload must contain data + NULL delimiters
-        constexpr const size_t secretLimit = 1024;
-        if (userName.size() + password.size() + 2 > secretLimit)
-        {
-            BMCWEB_LOG_ERROR("Credentials too long to handle");
-            messages::unrecognizedRequestBody(asyncResp->res);
-            return;
-        }
-
-        // Open pipe
-        secretPipe = std::make_shared<CredentialsPipe>(
+        messages::actionParameterValueFormatError(
+            asyncResp->res, userName, "Username", "VirtualMedia.InsertMedia");
+        return;
+    }
+    constexpr uint64_t limit = 512;
+    if (userName.size() > limit)
+    {
+        messages::stringValueTooLong(asyncResp->res, userName, limit);
+        return;
+    }
+    if (password.contains('\0'))
+    {
+        messages::actionParameterValueFormatError(
+            asyncResp->res, password, "Password", "VirtualMedia.InsertMedia");
+        return;
+    }
+    if (password.size() > limit)
+    {
+        messages::stringValueTooLong(asyncResp->res, password, limit);
+        return;
+    }
+    // Open pipe
+    std::shared_ptr<CredentialsPipe> secretPipe =
+        std::make_shared<CredentialsPipe>(
             crow::connections::systemBus->get_io_context());
-        fd = secretPipe->releaseFd();
+    int fd = secretPipe->releaseFd();
 
-        // Pass secret over pipe
-        secretPipe->asyncWrite(
-            std::move(userName), std::move(password),
-            [asyncResp,
-             secretPipe](const boost::system::error_code& ec, std::size_t) {
-                if (ec)
-                {
-                    BMCWEB_LOG_ERROR("Failed to pass secret: {}", ec);
-                    messages::internalError(asyncResp->res);
-                }
-            });
-    }
+    // Pass secret over pipe
+    secretPipe->asyncWrite(
+        std::move(userName), std::move(password),
+        [asyncResp,
+         secretPipe](const boost::system::error_code& ec, std::size_t) {
+            if (ec)
+            {
+                BMCWEB_LOG_ERROR("Failed to pass secret: {}", ec);
+                messages::internalError(asyncResp->res);
+            }
+        });
 
-    std::variant<sdbusplus::message::unix_fd> unixFd(
-        std::in_place_type<sdbusplus::message::unix_fd>, fd);
+    sdbusplus::message::unix_fd unixFd(fd);
 
     sdbusplus::message::object_path path(
         "/xyz/openbmc_project/VirtualMedia/Legacy");
     path /= name;
     crow::connections::systemBus->async_method_call(
-        [asyncResp,
-         secretPipe](const boost::system::error_code& ec, bool success) {
+        [asyncResp](const boost::system::error_code& ec, bool success) {
             if (ec)
             {
                 BMCWEB_LOG_ERROR("Bad D-Bus request error: {}", ec);