oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #229 from caryoscelus/improve-safere

Browse source 
Improve SafeRe
This commit is contained in:
caryoscelus 2023-08-07 13:11:53 +00:00 committed by GitHub
commit e34dcaeb57
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
plugins/Sidebar/ConsolePlugin.py
View file

@ -14,8 +14,7 @@ class WsLogStreamer(logging.StreamHandler):
self.ui_websocket = ui_websocket self.ui_websocket = ui_websocket
if filter: if filter:
if not SafeRe.isSafePattern(filter): SafeRe.guard(filter):
raise Exception("Not a safe prex pattern")
self.filter_re = re.compile(".*" + filter) self.filter_re = re.compile(".*" + filter)
else: else:
self.filter_re = None self.filter_re = None
@ -55,7 +54,7 @@ class UiWebsocketPlugin(object):
pos_start = log_file.tell() pos_start = log_file.tell()
lines = [] lines = []
if filter: if filter:
assert SafeRe.isSafePattern(filter) SafeRe.guard(filter)
filter_re = re.compile(".*" + filter) filter_re = re.compile(".*" + filter)
last_match = False last_match = False

19
src/util/SafeRe.py
View file

@ -7,7 +7,8 @@ class UnsafePatternError(Exception):
cached_patterns = {} cached_patterns = {}
def isSafePattern(pattern): def guard(pattern):
'''Checks if pattern is safe and raises exception if it isn't'''
if len(pattern) > 255: if len(pattern) > 255:
raise UnsafePatternError("Pattern too long: %s characters in %s" % (len(pattern), pattern)) raise UnsafePatternError("Pattern too long: %s characters in %s" % (len(pattern), pattern))
@ -15,18 +16,18 @@ def isSafePattern(pattern):
if unsafe_pattern_match: if unsafe_pattern_match:
raise UnsafePatternError("Potentially unsafe part of the pattern: %s in %s" % (unsafe_pattern_match.group(0), pattern)) raise UnsafePatternError("Potentially unsafe part of the pattern: %s in %s" % (unsafe_pattern_match.group(0), pattern))
repetitions = re.findall(r"\.[\*\{\+]", pattern) repetitions1 = re.findall(r"\.[\*\{\+]", pattern)
if len(repetitions) >= 10: repetitions2 = re.findall(r"[^(][?]", pattern)
raise UnsafePatternError("More than 10 repetitions of %s in %s" % (repetitions[0], pattern)) if len(repetitions1) + len(repetitions2) >= 10:
raise UnsafePatternError("More than 10 repetitions in %s" % pattern)
return True
def match(pattern, *args, **kwargs): def match(pattern, *args, **kwargs):
'''Guard for safety, compile, cache and match regexp'''
cached_pattern = cached_patterns.get(pattern) cached_pattern = cached_patterns.get(pattern)
if cached_pattern: if cached_pattern:
return cached_pattern.match(*args, **kwargs) return cached_pattern.match(*args, **kwargs)
else: else:
if isSafePattern(pattern): guard(pattern)
cached_patterns[pattern] = re.compile(pattern) cached_patterns[pattern] = re.compile(pattern)
return cached_patterns[pattern].match(*args, **kwargs) return cached_patterns[pattern].match(*args, **kwargs)