Skip to content

fix: sanitize subprocess call in main.py #940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anupamme wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: sanitize subprocess call in main.py #940

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion api/schemas/crawler.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,10 @@
# 详细许可条款请参阅项目根目录下的LICENSE文件。
# 使用本代码即表示您同意遵守上述原则和LICENSE中的所有条款。

import re
from enum import Enum
from typing import Optional, Literal
from pydantic import BaseModel, Field
from pydantic import BaseModel, Field, field_validator


MAX_API_LIMIT_COUNT = 10000
Expand Down Expand Up @@ -74,6 +75,23 @@ class CrawlerStartRequest(BaseModel):
save_option: SaveDataOptionEnum = SaveDataOptionEnum.JSONL
cookies: str = ""
headless: bool = False

@field_validator("keywords", "cookies", mode="before")
@classmethod
def sanitize_free_text(cls, v: str) -> str:
"""Remove null bytes and newlines to prevent argument injection."""
if isinstance(v, str):
return re.sub(r"[\x00\n\r]", "", v)
return v

@field_validator("specified_ids", "creator_ids", mode="before")
@classmethod
def validate_ids(cls, v: str) -> str:
"""Allow only alphanumeric characters, commas, hyphens, and underscores."""
if isinstance(v, str) and v:
if not re.fullmatch(r"[A-Za-z0-9,_\-\s]*", v):
raise ValueError("IDs must contain only alphanumeric characters, commas, hyphens, or underscores.")
return v
max_notes_count: Optional[int] = Field(default=None, ge=1, le=MAX_API_LIMIT_COUNT)
max_comments_count: Optional[int] = Field(default=None, ge=1, le=MAX_API_LIMIT_COUNT)

Expand Down