commops/feedcloud
16
0
Fork 0
Code Issues 1 Pull requests Activity

Feed title shinanigans? #1

New issue
Open
opened 2016-09-04 23:48:28 +00:00 by jflory7 · 0 comments
jflory7 commented 2016-09-04 23:48:28 +00:00
Owner
Copy link

Originally filed by dxa4481 on GitHub

So on this line
https://github.com/decause/feedcloud/blob/master/gencloud.py#L30

What happens if my feed title is something like

../../../../../../../home/decause/Documents/superSecretTextFile

@decause

Excellent question! Do you have any suggestions for a library that normalizes/validates URLs, or another strategy to protect against such shenanigans?

dxa4481

You can try this guy's solution (top answer, not the poster), it's a little lengthy but I think it works

https://stackoverflow.com/questions/6803505/does-my-code-prevent-directory-traversal

dxa4481

I think you got the same thing going on here. The HFOSS one is a little more serious because now you can access any file, not just .txt files. You might want to test out my hunch, I could be mistaken. Depends how the feed parser handles things

https://github.com/decause/hfoss/blob/master/hfossfeedpull.py#L25

_Originally filed by dxa4481 on [GitHub](https://github.com/decause/feedcloud/issues/1)_ ---- So on this line https://github.com/decause/feedcloud/blob/master/gencloud.py#L30 What happens if my feed title is something like `../../../../../../../home/decause/Documents/superSecretTextFile` ---- @decause Excellent question! Do you have any suggestions for a library that normalizes/validates URLs, or another strategy to protect against such shenanigans? ---- dxa4481 You can try this guy's solution (top answer, not the poster), it's a little lengthy but I think it works https://stackoverflow.com/questions/6803505/does-my-code-prevent-directory-traversal ---- dxa4481 I think you got the same thing going on here. The HFOSS one is a little more serious because now you can access any file, not just .txt files. You might want to test out my hunch, I could be mistaken. Depends how the feed parser handles things https://github.com/decause/hfoss/blob/master/hfossfeedpull.py#L25 ----
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
No results found.
Labels
Clear labels   
Closed As
Duplicate
 Closed with the reason of Duplicate

  
Closed As
Fixed
 Closed with the reason of Fixed

  
Closed As
Insufficient data
 Closed with the reason of Insufficient data

  
Closed As
Invalid
 Closed with the reason of Invalid

  
function
analytics
 Community Social Analytics. One of the two main functions of the Community Operations Team. All issues/tasks should identify a function as different team members are responsible for different function

  
function
communications
 Community Blog, newsletters, outreach content, Magazine coordination, and community messaging

  
function
docs
 Documentation site, playbooks, guides, knowledge base, and contributor reference materials

  
function
events
 Event production, release parties, conferences, streaming, video processing, and community event logistics

  
function
onboarding
 Newcomer experience, mentoring, intern programs, team growth, and contributor onboarding

  
function
operations
 Team governance, repo management, meeting logistics, infrastructure, and internal process

  
good first issue
Good tickets to begin with (if you want to get involved, try working on one of these!)

  
help wanted
Tickets where we need help or need feedback from the wider Fedora community

  
needs
changes
 Needs changes or fixes before closing

  
needs
reporter feedback
 Additional feedback or information from the reporter is needed to advance

  
needs
team vote
 A vote is required from Fedora Community Operations Team members in order to advance

  
needs
triage
 A repository maintainer is needed to triage this further

  
scope
bug
 Something isn't working

  
scope
improvement
 Requests for something we are either repeating or improving

  
scope
new
 Requests for a new task or project for the team

  
state
approved
 Tickets that received approval by the Fedora Community Operations Team

  
state
blocked
 Cannot move forward: blocked by feedback, other tickets, etc.

  
state
duplicate
 This issue or merge request already exists

  
state
invalid
 This doesn't seem right

  
state
wontfix
 This will not be worked on

No labels
Closed As
Duplicate
Closed As
Fixed
Closed As
Insufficient data
Closed As
Invalid
function
analytics
function
communications
function
docs
function
events
function
onboarding
function
operations
good first issue
help wanted
needs
changes
needs
reporter feedback
needs
team vote
needs
triage
scope
bug
scope
improvement
scope
new
state
approved
state
blocked
state
duplicate
state
invalid
state
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
commops/feedcloud#1
No description provided.