interesting
/
PeerTube
mirror of https://github.com/Chocobozzz/PeerTube.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add additional check for playlistName

This commit is contained in:
Chocobozzz 2023-02-27 09:44:03 +01:00
parent 4765348107
commit d7ce9dca61
No known key found for this signature in database
GPG Key ID: 583A612D890159BE
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server/helpers/custom-validators/misc.ts
View File

@ -15,6 +15,10 @@ function isSafePath (p: string) {
}) })
} }
function isSafePeerTubeFilenameWithoutExtension (filename: string) {
return filename.match(/^[a-z0-9-]+$/)
}
function isArray (value: any): value is any[] { function isArray (value: any): value is any[] {
return Array.isArray(value) return Array.isArray(value)
} }
@ -172,5 +176,6 @@ export {
areUUIDsValid, areUUIDsValid,
toIntArray, toIntArray,
isFileValid, isFileValid,
isSafePeerTubeFilenameWithoutExtension,
checkMimetypeRegex checkMimetypeRegex
} }

6
server/middlewares/validators/static.ts
View File

@ -2,7 +2,7 @@ import express from 'express'
import { query } from 'express-validator' import { query } from 'express-validator'
import LRUCache from 'lru-cache' import LRUCache from 'lru-cache'
import { basename, dirname } from 'path' import { basename, dirname } from 'path'
import { exists, isUUIDValid, toBooleanOrNull } from '@server/helpers/custom-validators/misc' import { exists, isSafePeerTubeFilenameWithoutExtension, isUUIDValid, toBooleanOrNull } from '@server/helpers/custom-validators/misc'
import { logger } from '@server/helpers/logger' import { logger } from '@server/helpers/logger'
import { LRU_CACHE } from '@server/initializers/constants' import { LRU_CACHE } from '@server/initializers/constants'
import { VideoModel } from '@server/models/video/video' import { VideoModel } from '@server/models/video/video'
@ -69,6 +69,10 @@ const ensureCanAccessPrivateVideoHLSFiles = [
.customSanitizer(toBooleanOrNull) .customSanitizer(toBooleanOrNull)
.isBoolean().withMessage('Should be a valid reinjectVideoFileToken boolean'), .isBoolean().withMessage('Should be a valid reinjectVideoFileToken boolean'),
query('playlistName')
.optional()
.customSanitizer(isSafePeerTubeFilenameWithoutExtension),
async (req: express.Request, res: express.Response, next: express.NextFunction) => { async (req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return if (areValidationErrors(req, res)) return