indymedia
/
epicyon
mirror of https://gitlab.com/bashrc2/epicyon
7
4
Fork 1
Code Issues 14 Releases Wiki Activity

Bad path start string

main
bashrc 2026-08-03 11:16:20 +01:00
parent 4f744098e7
commit e6e36db583
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/utils.py
View File

@ -4093,7 +4093,9 @@ def check_bad_path(path: str, allow_local_network_access: bool):
# allow /.well-known/... # allow /.well-known/...
if '/.' in path_lower: if '/.' in path_lower:
good_starts: list[str] = ('/.well-known/', '/users/.well-known/') good_starts: list[str] = (
'/.well-known/', '/users/.well-known/'
)
if string_starts_with(path_lower, good_starts): if string_starts_with(path_lower, good_starts):
bad_strings: list[str] = ['..', '%2e%2e', '%252e%252e'] bad_strings: list[str] = ['..', '%2e%2e', '%252e%252e']
@ -4117,7 +4119,7 @@ def check_bad_path(path: str, allow_local_network_access: bool):
if contains_ipv4_address(path_lower): if contains_ipv4_address(path_lower):
return True return True
bad_starts = ('/firebase', '/composer', '/sugar') bad_starts = ('/firebase', '/composer', '/sugar', '/_')
if string_starts_with(path_lower, bad_starts): if string_starts_with(path_lower, bad_starts):
return True return True