sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #50794 from nextcloud/fix/fix-appmanager-cleanappid 

fix: Only keep allowed characters in appid, and flag the method as escaping
pull/50801/head
Côme Chilliet 2025-02-13 17:23:44 +07:00 committed by GitHub
parent c71bc0696f 6e7c97ea1f
commit b003af2364
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 26 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/private/App/AppManager.php
Unescape Escape View File

@ -939,8 +939,23 @@ class AppManager implements IAppManager {
return false;
}
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*/
public function cleanAppId(string $app): string {
// FIXME should list allowed characters instead
return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app);
/* Only lowercase alphanumeric is allowed */
return preg_replace('/(^[0-9_]|[^a-z0-9_]+|_$)/', '', $app);
}
}

11
lib/public/App/IAppManager.php
Unescape Escape View File

@ -309,10 +309,17 @@ interface IAppManager {
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape include
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*
* @since 31.0.0
*/