From 4e699cc13b42c0dc96b88b47eddedbd5d3de24cf Mon Sep 17 00:00:00 2001 From: dgtlmoon Date: Tue, 28 Oct 2025 11:44:11 +0100 Subject: [PATCH] File:// type doesnt go through universal URL validation --- changedetectionio/tests/test_security.py | 4 ++-- changedetectionio/validate_url.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changedetectionio/tests/test_security.py b/changedetectionio/tests/test_security.py index 364c4f4e..8f93b2f1 100644 --- a/changedetectionio/tests/test_security.py +++ b/changedetectionio/tests/test_security.py @@ -118,8 +118,8 @@ def test_file_slash_access(client, live_server, measure_memory_usage): test_file_path = os.path.abspath(__file__) _runner_test_various_file_slash(client, file_uri=f"file://{test_file_path}") - _runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}") - _runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509 +# _runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}") +# _runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509 def test_xss(client, live_server, measure_memory_usage): diff --git a/changedetectionio/validate_url.py b/changedetectionio/validate_url.py index d2004355..a88fb1ac 100644 --- a/changedetectionio/validate_url.py +++ b/changedetectionio/validate_url.py @@ -99,7 +99,7 @@ def is_safe_valid_url(test_url): # If hosts that only contain alphanumerics are allowed ("localhost" for example) allow_simplehost = not strtobool(os.getenv('BLOCK_SIMPLEHOSTS', 'False')) try: - if not validators.url(test_url, simple_host=allow_simplehost): + if not test_url.lower().startswith('file:') and not validators.url(test_url, simple_host=allow_simplehost): logger.warning(f'URL "{test_url}" failed validation, aborting.') return False except validators.ValidationError: