Skip to content

Fixed incorrect sanitisation of URLs for package installation requests #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tieneupin merged 2 commits into from
Jan 21, 2025
Merged

Fixed incorrect sanitisation of URLs for package installation requests #457

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f3b740
Fixed incorrect sanitisation of URLs for package installation requests
tieneupin Jan 21, 2025
dc63cd0
Missed applying the fix to a few 'quote()' instances
tieneupin Jan 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions src/murfey/server/api/bootstrap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,15 +228,16 @@
"""

# Validate request path
if bool(re.fullmatch(r"^[\w\s\.\-/]+$", request_path)) is False:
if bool(re.fullmatch(r"^[\w\s\.\-\+/]+$", request_path)) is False:
raise ValueError(f"{request_path!r} is not a valid request path")

try:
url = f'{find_cygwin_mirror()}{quote(request_path, safe="")}'
url = f'{find_cygwin_mirror()}{quote(request_path, safe="/")}'

Check warning on line 235 in src/murfey/server/api/bootstrap.py

View check run for this annotation

Codecov / codecov/patch

src/murfey/server/api/bootstrap.py#L235 

Added line #L235 was not covered by tests
except Exception:
raise HTTPException(
status_code=503, detail="Could not identify a suitable Cygwin mirror"
)

logger.info(f"Forwarding Cygwin download request to {_sanitise_str(url)}")
cygwin_data = requests.get(url)
return Response(
Expand Down Expand Up @@ -434,7 +435,7 @@
raise ValueError(f"{system!r} is not a valid msys2 environment")

# Construct URL to main MSYS repo and get response
arch_url = f'{msys2_url}/{quote(system, safe="")}'
arch_url = f'{msys2_url}/{quote(system, safe="/")}'

Check warning on line 438 in src/murfey/server/api/bootstrap.py

View check run for this annotation

Codecov / codecov/patch

src/murfey/server/api/bootstrap.py#L438 

Added line #L438 was not covered by tests
response = requests.get(arch_url)

# Parse and rewrite package index content
Expand Down Expand Up @@ -497,7 +498,7 @@

# Construct URL to main MSYS repo and get response
package_list_url = (
f'{msys2_url}/{quote(system, safe="")}/{quote(environment, safe="")}'
f'{msys2_url}/{quote(system, safe="/")}/{quote(environment, safe="/")}'
)
response = requests.get(package_list_url)

Expand Down Expand Up @@ -551,7 +552,7 @@
raise ValueError(f"{package!r} is not a valid package name")

# Construct URL to main MSYS repo and get response
package_url = f'{msys2_url}/{quote(system, safe="")}/{quote(environment, safe="")}/{quote(package, safe="")}'
package_url = f'{msys2_url}/{quote(system, safe="/")}/{quote(environment, safe="/")}/{quote(package, safe="/")}'

Check warning on line 555 in src/murfey/server/api/bootstrap.py

View check run for this annotation

Codecov / codecov/patch

src/murfey/server/api/bootstrap.py#L555 

Added line #L555 was not covered by tests
package_file = requests.get(package_url)

if package_file.status_code == 200:
Expand Down Expand Up @@ -581,7 +582,7 @@
# alphanumerics (including underscores; \w), dashes (\-), and periods (\.)
if re.match(r"^[\w\-\.]+$", package) is not None:
# Sanitise and normalise package name according to PEP 503
package_clean = quote(re.sub(r"[-_.]+", "-", package.lower()), safe="")
package_clean = quote(re.sub(r"[-_.]+", "-", package.lower()), safe="/")

# Get HTTP response
url = f"https://pypi.org/simple/{package_clean}"
Expand Down
Loading