fix(occ): prevent params command key from overriding validated allowlist command (#41577)

* fix(occ): prevent params command key from overriding validated allowlist command

OccController::execute() validated the URL-path $command against the
allowlist, then called array_merge(["command"=>$command], $params).
PHP's array_merge with string keys lets later values overwrite earlier
ones, so a "command" key in the POST body $params silently replaced the
validated command, allowing execution of any occ command.

Add unset($params["command"]) before the merge to strip any
attacker-supplied command key, ensuring the validated value is always
what reaches Symfony Console.

Signed-off-by: Thomas Müller <thomas.mueller@owncloud.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* chore: add changelog entry for #41577

Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

---------

Signed-off-by: Thomas Müller <thomas.mueller@owncloud.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

Author: DeepDiver1975

changelog/unreleased/41577

@@ -0,0 +1,10 @@
+Security: Prevent params body from overriding validated occ command
+
+OccController validated the URL-path command against an allowlist but
+then merged it with user-supplied params via array_merge, allowing a
+command key in the request body to overwrite the validated value. An
+authenticated caller with the updater secret could use this to execute
+any occ command regardless of the allowlist. The params array is now
+stripped of any command key before the merge.
+
+https://github.com/owncloud/core/pull/41577

core/Controller/OccController.php

@@ -106,6 +106,8 @@ public function execute($command, $token, $params = []) {
 			$this->console->setAutoExit(false);
 			$this->console->loadCommands(new ArrayInput([]), $output);
 
+			// Prevent user-supplied params from overriding the validated command
+			unset($params['command']);
 			$inputArray = \array_merge(['command' => $command], $params);
 			$input = new ArrayInput($inputArray);
 

tests/Core/Controller/OccControllerTest.php

@@ -84,6 +84,42 @@ public function testWrongToken() {
 		$this->assertEquals('updater.secret does not match the provided token', $responseData['details']);
 	}
 
+	/**
+	 * Ensure that a 'command' key inside params cannot override the validated
+	 * command (CVE allowlist-bypass via array_merge key collision).
+	 */
+	public function testParamsCommandKeyCannotOverrideValidatedCommand() {
+		$this->getControllerMock('localhost');
+
+		// Track which command the console is actually asked to run
+		$capturedInput = null;
+		$this->console->expects($this->once())->method('run')
+			->willReturnCallback(
+				function ($input, $output) use (&$capturedInput) {
+					$capturedInput = $input;
+					return 0;
+				}
+			);
+
+		// 'status' is an allowed command; 'user:resetpassword' is not.
+		// The attacker embeds 'command' => 'user:resetpassword' inside params.
+		$response = $this->controller->execute(
+			'status',
+			self::TEMP_SECRET,
+			['command' => 'user:resetpassword', '--output' => 'json']
+		);
+		$responseData = $response->getData();
+
+		// Request must succeed (the validated command ran)
+		$this->assertArrayHasKey('exitCode', $responseData);
+		$this->assertEquals(0, $responseData['exitCode']);
+
+		// The ArrayInput actually passed to the console must carry 'status',
+		// not the attacker-supplied 'user:resetpassword'.
+		$this->assertNotNull($capturedInput);
+		$this->assertEquals('status', $capturedInput->getFirstArgument());
+	}
+
 	public function testSuccess() {
 		$this->getControllerMock('localhost');
 		$this->console->expects($this->once())->method('run')