[Backport request] CVE-2024-10964 — strcpy buffer overflow in plugin_handle.c not backported to v2.9

[vulgraph]

Hi @emqx maintainers,

While reviewing security backports across v2.x branches I noticed that the upstream fix for CVE-2024-10964 (commit 3e3a583d) does not appear to be present on the v2.9 branch.

Evidence

• Upstream fix on main: strcpy(cmd.library, req->library) → strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN) in both handle_add_plugin() and handle_update_plugin() of plugins/restful/plugin_handle.c.
• v2.9 HEAD (72cab4a0c815) still contains the vulnerable lines:

  void handle_add_plugin(nng_aio *aio) {
      ...
      strcpy(cmd.library, req->library);  // CVE-2024-10964 unbounded copy
      ...
  }
  void handle_update_plugin(nng_aio *aio) {
      ...
      strcpy(cmd.library, req->library);  // CVE-2024-10964 unbounded copy
      ...
  }

• compare v2.9...main: status=diverged, ahead=592, behind=139 — so a maintained branch.
• No commit on v2.9 matching the upstream title plugin:buffer overflow.

A minimal backport is just the two strcpy → strncpy lines (the upstream patch is +2/-2); the surrounding otel_trace_type lines from the master fix are not present on v2.9 and can be dropped.

Would you consider cherry-picking (or applying the equivalent two-line change) onto the v2.9 maintenance branch?

Thanks!