a3x/nyaa
1
0
Fork 0
mirror of https://gitlab.com/SIGBUS/nyaa.git synced 2024-12-21 17:20:01 +00:00
Code Issues Projects Releases Wiki Activity

backend: blacklist Windows reserved filenames (#527)

Browse source 
Windows has a few special filenames that it does not allow the
explorer.exe and command line to see, but can still be created by
applications. This is due to some jank DOS compatibility.

These filenames can be abused to troll Windows users, so we should
probably blacklist them.
This commit is contained in:
Nicolas F 2018-10-27 16:13:44 +02:00 committed by Anna-Maria Meriniemi
parent b2ddba994c
commit c967b831c6
1 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
nyaa/backend.py
View file

@ -14,6 +14,21 @@ from nyaa.extensions import db
app = flask.current_app
# Blacklists for _validate_torrent_filenames
# TODO: consider moving to config.py?
CHARACTER_BLACKLIST = [
'\u202E', # RIGHT-TO-LEFT OVERRIDE
]
FILENAME_BLACKLIST = [
# Windows reserved filenames
'con',
'nul',
'prn',
'aux',
'com0', 'com1', 'com2', 'com3', 'com4', 'com5', 'com6', 'com7', 'com8', 'com9',
'lpt0', 'lpt1', 'lpt2', 'lpt3', 'lpt4', 'lpt5', 'lpt6', 'lpt7', 'lpt8', 'lpt9',
]
class TorrentExtraValidationException(Exception):
def __init__(self, errors={}):
@ -62,16 +77,14 @@ def _recursive_dict_iterator(source):
def _validate_torrent_filenames(torrent):
''' Checks path parts of a torrent's filetree against blacklisted characters,
returning False on rejection '''
# TODO Move to config.py
character_blacklist = [
'\u202E', # RIGHT-TO-LEFT OVERRIDE
]
''' Checks path parts of a torrent's filetree against blacklisted characters
and filenames, returning False on rejection '''
file_tree = json.loads(torrent.filelist.filelist_blob.decode('utf-8'))
for path_part, value in _recursive_dict_iterator(file_tree):
if any(True for c in character_blacklist if c in path_part):
if path_part.rsplit('.', 1)[0].lower() in FILENAME_BLACKLIST:
return False
if any(True for c in CHARACTER_BLACKLIST if c in path_part):
return False
return True