From 5c4181a9ab7dca0c0fff0758c33010e06c73ebb3 Mon Sep 17 00:00:00 2001 From: Bob Mottram Date: Tue, 10 Nov 2020 21:05:41 +0000 Subject: [PATCH 01/85] Back button is deprecated --- webapp_search.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/webapp_search.py b/webapp_search.py index 958f91eb3..7b2a8b138 100644 --- a/webapp_search.py +++ b/webapp_search.py @@ -390,8 +390,6 @@ def htmlSearch(cssCache: {}, translate: {}, followStr += \ ' \n' followStr += '
\n' - # followStr += ' \n' followStr += ' \n' followStr += ' \n' From cadd0de15c8d278c9e3285a85b70ac9138476a85 Mon Sep 17 00:00:00 2001 From: Bob Mottram Date: Wed, 11 Nov 2020 09:42:48 +0000 Subject: [PATCH 02/85] Don't allow local network access --- content.py | 4 ++++ tests.py | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/content.py b/content.py index 95181a865..532668ffe 100644 --- a/content.py +++ b/content.py @@ -159,6 +159,7 @@ def dangerousMarkup(content: str) -> bool: if '>' not in content: return False contentSections = content.split('<') + invalidPartials = ('127.0.', '192.168', '10.0.') invalidStrings = ('script', 'canvas', 'style', 'abbr', 'frame', 'iframe', 'html', 'body', 'hr') @@ -166,6 +167,9 @@ def dangerousMarkup(content: str) -> bool: if '>' not in markup: continue markup = markup.split('>')[0].strip() + for partialMatch in invalidPartials: + if partialMatch in markup: + return True if ' ' not in markup: for badStr in invalidStrings: if badStr in markup: diff --git a/tests.py b/tests.py index f835378c0..0431387a0 100644 --- a/tests.py +++ b/tests.py @@ -1943,32 +1943,52 @@ def testDangerousMarkup(): print('testDangerousMarkup') content = '

This is a valid message

' assert(not dangerousMarkup(content)) + content = 'This is a valid message without markup' assert(not dangerousMarkup(content)) + content = '

This is a valid-looking message. But wait... ' + \ '

' assert(dangerousMarkup(content)) + content = '

This is a valid-looking message. But wait... ' + \ '