Skip to content

Commit

Permalink
isup: block querying invalid/test TLDs & local names with dot in path
Browse files Browse the repository at this point in the history
Includes tests, since that's how I verified that it used to be allowed.
  • Loading branch information
dgw committed Sep 20, 2020
1 parent 2863d72 commit 524a8b4
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 3 deletions.
7 changes: 4 additions & 3 deletions sopel/modules/isup.py
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,11 @@ def get_site_url(site):

site = 'http://' + site

if '.' not in site:
# TODO: Make this more robust against e.g.
# .isup lanpeer/path/to/some/IoT.service
domain = site.split('/')[2]
if '.' not in domain:
raise ValueError('I need a fully qualified domain name (with a dot).')
if domain.endswith(('.local', '.example', '.test', '.invalid', '.localhost')):
raise ValueError("I can't check LAN-local or invalid domains.")

return site

Expand Down
2 changes: 2 additions & 0 deletions test/modules/test_modules_isup.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@ def test_get_site_url(site, expected):
'steam://browsemedia', # invalid protocol
'://', # invalid protocol (that's a weird one)
'example', # no TLD, no scheme
'something.local', # LAN-local address
'lanmachine/path/to/iot.device', # unqualified name with dot in path
)


Expand Down

0 comments on commit 524a8b4

Please sign in to comment.