Browse Source

Prevent smuggling in a grep option

master
JustAnotherArchivist 3 years ago
parent
commit
1810c04f7d
1 changed files with 1 additions and 0 deletions
  1. +1
    -0
      irclog.py

+ 1
- 0
irclog.py View File

@@ -1078,6 +1078,7 @@ class WebServer:
]
if 'casesensitive' not in request.query:
cmd.append('--ignore-case')
cmd.append('--')
cmd.append(request.query['q'])
for path in itertools.chain((request.match_info['path'],), self._paths[request.match_info['path']][3]):
cmd.append(os.path.join(self.config['storage']['path'], path, ''))


Loading…
Cancel
Save