main
Bob Mottram 2024-04-10 13:59:57 +01:00
parent d3e343c231
commit 85cc2eb22d
3 changed files with 8 additions and 10 deletions

View File

@ -12,6 +12,7 @@ import json
import time
from session import get_json_valid
from session import create_session
from utils import string_contains
from utils import date_from_string_format
from utils import date_utcnow
from utils import remove_eol
@ -1998,10 +1999,7 @@ def save_block_federated_endpoints(base_dir: str,
if not endpoint:
continue
if '.' not in endpoint or \
' ' in endpoint or \
'<' in endpoint or \
',' in endpoint or \
';' in endpoint:
string_contains(endpoint, (' ', '<', ',', ';')):
continue
if endpoint.startswith('@'):
endpoint = endpoint[1:]

View File

@ -15,6 +15,7 @@ import email.parser
import urllib.parse
from shutil import copyfile
from dateutil.parser import parse
from utils import string_contains
from utils import string_ends_with
from utils import is_account_dir
from utils import get_url_from_post
@ -263,9 +264,7 @@ def dangerous_css(filename: str, allow_local_network_access: bool) -> bool:
if ctr > 0:
if ')' in url_str:
url_str = url_str.split(')')[0]
if 'http' in url_str or \
'ipfs' in url_str or \
'ipns' in url_str:
if string_contains(url_str, ('http', 'ipfs', 'ipns')):
print('ERROR: non-local web link in CSS ' +
filename)
return True

View File

@ -50,6 +50,7 @@ from shares import expire_shares
from categories import load_city_hashtags
from categories import update_hashtag_categories
from languages import load_default_post_languages
from utils import string_contains
from utils import check_bad_path
from utils import acct_handle_dir
from utils import load_reverse_timeline
@ -310,9 +311,9 @@ class PubServer(BaseHTTPRequestHandler):
file_length = -1
last_modified_time_str = None
if '/media/' in self.path or \
'/accounts/avatars/' in self.path or \
'/accounts/headers/' in self.path:
if string_contains(self.path,
('/media/', '/accounts/avatars/',
'/accounts/headers/')):
if is_image_file(self.path) or \
path_is_video(self.path) or \
path_is_audio(self.path):