From 491ed4f4002848d891f1f03f38fcb36aa3735b43 Mon Sep 17 00:00:00 2001 From: Luca Versari Date: Fri, 16 Oct 2026 08:12:40 +0200 Subject: [PATCH] Fix username validation in rws. --- cmsranking/RankingWebServer.py | 6 +++--- cmsranking/Store.py | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/cmsranking/RankingWebServer.py b/cmsranking/RankingWebServer.py index 3fa34644ac..7d6961adc3 100755 --- a/cmsranking/RankingWebServer.py +++ b/cmsranking/RankingWebServer.py @@ -131,7 +131,7 @@ def authorized(self, request: Request): def get(self, request: Request, response: Response, key: str): # Limit charset of keys. - if re.match("^[A-Za-z0-9_]+$", key) is None: + if re.fullmatch("[A-Za-z0-9_]+", key) is None: return NotFound() if key not in self.store: raise NotFound() @@ -149,7 +149,7 @@ def get_list(self, request: Request, response: Response): def put(self, request: Request, response: Response, key: str): # Limit charset of keys. - if re.match("^[A-Za-z0-9_]+$", key) is None: + if re.fullmatch("[A-Za-z0-9_]+", key) is None: return Forbidden() if not self.authorized(request): logger.warning("Unauthorized request.", @@ -213,7 +213,7 @@ def put_list(self, request: Request, response: Response): def delete(self, request: Request, response: Response, key: str): # Limit charset of keys. - if re.match("^[A-Za-z0-9_]+$", key) is None: + if re.fullmatch("[A-Za-z0-9_]+", key) is None: return NotFound() if key not in self.store: raise NotFound() diff --git a/cmsranking/Store.py b/cmsranking/Store.py index 6d14b1dd57..009559c59f 100644 --- a/cmsranking/Store.py +++ b/cmsranking/Store.py @@ -89,8 +89,7 @@ def load_from_disk(self): try: for name in os.listdir(self._path): - # TODO check that the key is '[A-Za-z0-9_]+' - if name[-5:] == '.json' and name[:-5] != '': + if name[-5:] == '.json' and re.fullmatch('[A-Za-z0-9_]+', name[:-5]): with open(os.path.join(self._path, name), 'rb') as rec: item = self._entity() item.set(json.load(rec)) @@ -148,7 +147,9 @@ def create(self, key: str, data: dict): some properties or if properties are of the wrong type. """ - if not isinstance(key, str) or key in self._store: + if not isinstance(key, str) or not re.fullmatch('[A-Za-z0-9_]+', key): + raise InvalidKey("Invalid key.") + if key in self._store: raise InvalidKey("Key already in store.") # create entity @@ -232,7 +233,7 @@ def merge_list(self, data_dict: dict[str, dict]): try: # FIXME We should allow keys to be arbitrary unicode # strings, so this just needs to be a non-empty check. - if not re.match('[A-Za-z0-9_]+', key): + if not isinstance(key, str) or not re.fullmatch('[A-Za-z0-9_]+', key): raise InvalidData("Invalid key") item = self._entity() item.set(value)