lee/changedetection.io
1
0
Fork 0
mirror of https://github.com/dgtlmoon/changedetection.io.git synced 2026-07-26 09:02:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

File:// type doesnt go through universal URL validation

Browse Source
This commit is contained in:
dgtlmoon
2025-10-28 11:44:11 +01:00
parent 964302cf3c
commit 4e699cc13b
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changedetectionio/tests/test_security.py
+2 -2
View File
@@ -118,8 +118,8 @@ def test_file_slash_access(client, live_server, measure_memory_usage):
test_file_path = os.path.abspath(__file__)
_runner_test_various_file_slash(client, file_uri=f"file://{test_file_path}")
_runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}")
_runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509
# _runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}")
# _runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509
def test_xss(client, live_server, measure_memory_usage):
changedetectionio/validate_url.py
+1 -1
View File
@@ -99,7 +99,7 @@ def is_safe_valid_url(test_url):
# If hosts that only contain alphanumerics are allowed ("localhost" for example)
allow_simplehost = not strtobool(os.getenv('BLOCK_SIMPLEHOSTS', 'False'))
try:
if not validators.url(test_url, simple_host=allow_simplehost):
if not test_url.lower().startswith('file:') and not validators.url(test_url, simple_host=allow_simplehost):
logger.warning(f'URL "{test_url}" failed validation, aborting.')
return False
except validators.ValidationError: