From e6e36db583b9b442af9f7f4dc92201058f149193 Mon Sep 17 00:00:00 2001 From: bashrc Date: Mon, 3 Aug 2026 11:16:20 +0100 Subject: [PATCH] Bad path start string --- src/utils.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/utils.py b/src/utils.py index c45eb65f9..980b647d2 100644 --- a/src/utils.py +++ b/src/utils.py @@ -4093,7 +4093,9 @@ def check_bad_path(path: str, allow_local_network_access: bool): # allow /.well-known/... if '/.' in path_lower: - good_starts: list[str] = ('/.well-known/', '/users/.well-known/') + good_starts: list[str] = ( + '/.well-known/', '/users/.well-known/' + ) if string_starts_with(path_lower, good_starts): bad_strings: list[str] = ['..', '%2e%2e', '%252e%252e'] @@ -4117,7 +4119,7 @@ def check_bad_path(path: str, allow_local_network_access: bool): if contains_ipv4_address(path_lower): return True - bad_starts = ('/firebase', '/composer', '/sugar') + bad_starts = ('/firebase', '/composer', '/sugar', '/_') if string_starts_with(path_lower, bad_starts): return True