main
Bob Mottram 2024-04-10 13:59:57 +01:00
parent d3e343c231
commit 85cc2eb22d
3 changed files with 8 additions and 10 deletions

View File

@ -12,6 +12,7 @@ import json
import time import time
from session import get_json_valid from session import get_json_valid
from session import create_session from session import create_session
from utils import string_contains
from utils import date_from_string_format from utils import date_from_string_format
from utils import date_utcnow from utils import date_utcnow
from utils import remove_eol from utils import remove_eol
@ -1998,10 +1999,7 @@ def save_block_federated_endpoints(base_dir: str,
if not endpoint: if not endpoint:
continue continue
if '.' not in endpoint or \ if '.' not in endpoint or \
' ' in endpoint or \ string_contains(endpoint, (' ', '<', ',', ';')):
'<' in endpoint or \
',' in endpoint or \
';' in endpoint:
continue continue
if endpoint.startswith('@'): if endpoint.startswith('@'):
endpoint = endpoint[1:] endpoint = endpoint[1:]

View File

@ -15,6 +15,7 @@ import email.parser
import urllib.parse import urllib.parse
from shutil import copyfile from shutil import copyfile
from dateutil.parser import parse from dateutil.parser import parse
from utils import string_contains
from utils import string_ends_with from utils import string_ends_with
from utils import is_account_dir from utils import is_account_dir
from utils import get_url_from_post from utils import get_url_from_post
@ -263,9 +264,7 @@ def dangerous_css(filename: str, allow_local_network_access: bool) -> bool:
if ctr > 0: if ctr > 0:
if ')' in url_str: if ')' in url_str:
url_str = url_str.split(')')[0] url_str = url_str.split(')')[0]
if 'http' in url_str or \ if string_contains(url_str, ('http', 'ipfs', 'ipns')):
'ipfs' in url_str or \
'ipns' in url_str:
print('ERROR: non-local web link in CSS ' + print('ERROR: non-local web link in CSS ' +
filename) filename)
return True return True

View File

@ -50,6 +50,7 @@ from shares import expire_shares
from categories import load_city_hashtags from categories import load_city_hashtags
from categories import update_hashtag_categories from categories import update_hashtag_categories
from languages import load_default_post_languages from languages import load_default_post_languages
from utils import string_contains
from utils import check_bad_path from utils import check_bad_path
from utils import acct_handle_dir from utils import acct_handle_dir
from utils import load_reverse_timeline from utils import load_reverse_timeline
@ -310,9 +311,9 @@ class PubServer(BaseHTTPRequestHandler):
file_length = -1 file_length = -1
last_modified_time_str = None last_modified_time_str = None
if '/media/' in self.path or \ if string_contains(self.path,
'/accounts/avatars/' in self.path or \ ('/media/', '/accounts/avatars/',
'/accounts/headers/' in self.path: '/accounts/headers/')):
if is_image_file(self.path) or \ if is_image_file(self.path) or \
path_is_video(self.path) or \ path_is_video(self.path) or \
path_is_audio(self.path): path_is_audio(self.path):