sim1222/fedi-block-api
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent single-character search DoS

Browse Source
This commit is contained in:
Mint 2022-11-27 23:02:12 +03:00
parent 8782880b04
commit 33a3c455e0
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
api.py
View File

@ -34,13 +34,16 @@ def info():
def blocked(domain: str = None, reason: str = None): def blocked(domain: str = None, reason: str = None):
if domain == None and reason == None: if domain == None and reason == None:
raise HTTPException(status_code=400, detail="No filter specified") raise HTTPException(status_code=400, detail="No filter specified")
conn = sqlite3.connect("blocks.db") if domain == None and reason == None:
c = conn.cursor() c = conn.cursor()
if domain != None: if domain != None:
wildchar = "*." + ".".join(domain.split(".")[-domain.count("."):]) wildchar = "*." + ".".join(domain.split(".")[-domain.count("."):])
punycode = domain.encode('idna').decode('utf-8') punycode = domain.encode('idna').decode('utf-8')
c.execute("select blocker, blocked, block_level, reason from blocks where blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ?", c.execute("select blocker, blocked, block_level, reason from blocks where blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ?",
(domain, "*." + domain, wildchar, get_hash(domain), punycode, "*." + punycode)) (domain, "*." + domain, wildchar, get_hash(domain), punycode, "*." + punycode))
else:
if len(reason) < 3:
raise HTTPException(status_code=400, detail="Keyword is shorter than three characters")
else: else:
c.execute("select blocker, blocked, reason, block_level from blocks where reason like ? and reason != ''", ("%"+reason+"%",)) c.execute("select blocker, blocked, reason, block_level from blocks where reason like ? and reason != ''", ("%"+reason+"%",))
blocks = c.fetchall() blocks = c.fetchall()