lee/changedetection.io
1
0
Fork 0
mirror of https://github.com/dgtlmoon/changedetection.io.git synced 2025-12-11 18:45:34 +00:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

CVE-2024-51998 - file:/ path traversal access should not be allowed to access a file without ALLOW_FILE_URI set

Browse Source
This commit is contained in:
dgtlmoon
2024-11-07 18:44:08 +01:00
parent e0abf0b505
commit 49bc982c69
2 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
changedetectionio/processors/__init__.py
View File

@@ -33,8 +33,8 @@ class difference_detection_processor():
url = self.watch.link
# Protect against file:// access, check the real "link" without any meta "source:" etc prepended.
if re.search(r'^file://', url, re.IGNORECASE):
# Protect against file://, file:/ access, check the real "link" without any meta "source:" etc prepended.
if re.search(r'^file:/', url.strip(), re.IGNORECASE):
if not strtobool(os.getenv('ALLOW_FILE_URI', 'false')):
raise Exception(
"file:// type access is denied for security reasons."