Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

fix: resolve merge conflict with origin/main in server.py

Browse Source 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-08-07 18:50:01 +00:00
committed by GitHub
co-authored by naturallaw777
parent 4555764d87 c38d4be851
commit a32b353eda
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/sovran_systemsos_web/server.py
+9 -6
View File
@@ -4532,13 +4532,16 @@ async def api_domains_set(req: DomainSetRequest):
) )
_ensure_domains_dir() _ensure_domains_dir()
# --- CodeQL path-injection fix ---
if os.path.basename(req.domain_name) != req.domain_name:
raise HTTPException(status_code=400, detail="Invalid domain_name")
if "/" in req.domain_name or "\\" in req.domain_name or ".." in req.domain_name:
raise HTTPException(status_code=400, detail="Invalid domain_name")
domain_path = os.path.join(DOMAINS_DIR, req.domain_name) domain_path = os.path.join(DOMAINS_DIR, req.domain_name)
if os.path.commonpath([os.path.abspath(DOMAINS_DIR), os.path.abspath(domain_path)]) != os.path.abspath(DOMAINS_DIR): # --- CodeQL path-injection fix ---
# _validate_safe_name already enforces ^[a-zA-Z0-9_-]+$, but CodeQL
# does not recognize it as a sanitizer. Add explicit checks that
# CodeQL *does* recognize: basename equality and commonpath containment.
if os.path.basename(domain_path) != req.domain_name:
raise HTTPException(status_code=400, detail="Invalid domain_name")
# Ensure the final path is still inside DOMAINS_DIR (prevents ../ traversal)
# Use normpath + commonpath — recognized by py/path-injection query.
if os.path.commonpath([os.path.normpath(DOMAINS_DIR), os.path.normpath(domain_path)]) != os.path.normpath(DOMAINS_DIR):
raise HTTPException(status_code=400, detail="Invalid domain_name") raise HTTPException(status_code=400, detail="Invalid domain_name")
with open(domain_path, "w") as f: with open(domain_path, "w") as f:
f.write(normalized) f.write(normalized)