NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

efc's avatar
efc
Aspirant
Jul 27, 2021

Attached Devices Javascript Error

I am running firmware V1.0.2.82 and still getting the empty attached devices problem. Today I did a bit of Javascript debugging and learned that the router is chocking on the returned result of its own API call to itself. I can make the same API call and I get the list of routers. Here's the call:

 

curl -u admin:password http://192.168.1.1/QOS_device_info.htm > devices.json

 

This leaves me with a file named "devices.json" with the response the router usually gives itself. However, when processing this result the router generates a "SyntaxError: Unexpected EOF".

I believe this is because one of my devices has a name with an embedded carriage return. Unfortunately I cannot change this device's name for itself. Even more unfortunate, the router in generating the JSON response to this API call does not do any sanity checking or cleanup of the device names. And then, when trying to use this mangled respone, it chokes.

I hope someone at Netgear is reading this thread and can fix this bug. Netgear really should be processing the names of all devices to make sure that only valid JSON is generated for the response. It might also want to consider a different way of ingesting this response since, in fact, all the data is there but clearly the consumer of this response is not seeing past the errant new line.

Meanwhile, for those of you looking for a list of attached devices, at least you can use the API call directly to get some semblance of that list.

 

1 Reply

  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jul 28, 2021

    The story is almost as old as the many attempts to derive Attached Devices lists and the like from the DHCP/BOOTP client provied host name.

     

    Root cause: RFC ignorants! When walking the RFC trees for DHCP, BOOTP et all, one does come to RFC 1035, where it says:

     

    The labels must follow the rules for ARPANET host names.  They must
start with a letter, end with a letter or digit, and have as interior
characters only letters, digits, and hyphen.  There are also some
restrictions on the length.  Labels must be 63 characters or less.

     

    My Google Pixel phone (Device Name) is named "Pixel 4a (5G)". It's dhcpd does provide the host name as part of the request as "pixel-4a-5g". When I find device like "Cath's iPhone 12" in the same context, you might understand what I'm thinking about that other Californian company.... And then, for some reson my defintion for small devices with Internet access are IoJ.

     

    Second line of defense:

     

    Already the router DHCP server should normalize and validate data provided - before it's stored in some internal table. Otherwise some bad guys might come and inject some 63 (or even more?) chars with JavaScript, or whatever interesting ideas. This table can be read then to generate the JSON ... and magic, it would just work, always.

     

    So of course, I'm fully with you efc .

     

    Regards,

    -Kurt