Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Merge pull request #426 from naturallaw777/fix/ddns-validation-placeholder

Browse Source 
Fix DDNS URL validation: replace ${IP} temporarily for validator, kee…
This commit is contained in:
Sovran Systems
2026-08-11 11:51:53 -05:00
committed by GitHub
parent 1b43a34e9c 679c7a039f
commit 802474fe6d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/sovran_systemsos_web/server.py
+4 -2
View File
@@ -4730,9 +4730,11 @@ async def api_domains_set(req: DomainSetRequest):
# Replace trailing &auto with the IP placeholder used by _run_njalla_ddns # Replace trailing &auto with the IP placeholder used by _run_njalla_ddns
if ddns_url.endswith("&auto"): if ddns_url.endswith("&auto"):
ddns_url = ddns_url[:-5] + "&a=${IP}" ddns_url = ddns_url[:-5] + "&a=${IP}"
# Validate URL strictly — reject injection attempts before persisting # Validate URL strictly — reject injection attempts before persisting.
# The placeholder ${IP} is replaced temporarily so the validator sees a
# real address; the original URL (with the placeholder) is kept for storage.
try: try:
ddns_url = _validate_ddns_url(ddns_url) _validate_ddns_url(ddns_url.replace("${IP}", "127.0.0.1"))
except ValueError as exc: except ValueError as exc:
raise HTTPException(status_code=400, detail=f"Invalid DDNS URL: {exc}") raise HTTPException(status_code=400, detail=f"Invalid DDNS URL: {exc}")
# Persist the URL in the JSON store (never in executable shell source) # Persist the URL in the JSON store (never in executable shell source)