fix security check

This commit is contained in:
dgtlmoon
2023-11-07 14:51:46 +01:00
parent d7bc2bd3f6
commit ebc7a7e568
2 changed files with 7 additions and 6 deletions

View File

@@ -1,6 +1,7 @@
from abc import abstractmethod
import os
import hashlib
import re
from copy import deepcopy
from changedetectionio import content_fetcher
@@ -18,6 +19,12 @@ class difference_detection_processor():
self.datastore = datastore
self.watch = deepcopy(self.datastore.data['watching'].get(watch_uuid))
# Protect against file:// access
if re.search(r'^file', self.watch.get('url', ''), re.IGNORECASE) and not os.getenv('ALLOW_FILE_URI', False):
raise Exception(
"file:// type access is denied for security reasons."
)
def call_browser(self):

View File

@@ -44,12 +44,6 @@ class perform_site_check(difference_detection_processor):
if not watch:
raise Exception("Watch no longer exists.")
# Protect against file:// access
if re.search(r'^file', watch.get('url', ''), re.IGNORECASE) and not os.getenv('ALLOW_FILE_URI', False):
raise Exception(
"file:// type access is denied for security reasons."
)
# Unset any existing notification error
update_obj = {'last_notification_error': False, 'last_error': False}