From 8f57a5076717280b2450ba2737d0c214bf45b314 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Thu, 13 Feb 2025 14:21:36 +0100 Subject: [PATCH] fix: Only keep allowed characters in appid, and flag the method as escaping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- lib/private/App/AppManager.php | 19 +++++++++++++++++-- lib/public/App/IAppManager.php | 11 +++++++++-- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/lib/private/App/AppManager.php b/lib/private/App/AppManager.php index 84dde3be712..544b304b9bd 100644 --- a/lib/private/App/AppManager.php +++ b/lib/private/App/AppManager.php @@ -939,8 +939,23 @@ class AppManager implements IAppManager { return false; } + /** + * Clean the appId from forbidden characters + * + * @psalm-taint-escape callable + * @psalm-taint-escape cookie + * @psalm-taint-escape file + * @psalm-taint-escape has_quotes + * @psalm-taint-escape header + * @psalm-taint-escape html + * @psalm-taint-escape include + * @psalm-taint-escape ldap + * @psalm-taint-escape shell + * @psalm-taint-escape sql + * @psalm-taint-escape unserialize + */ public function cleanAppId(string $app): string { - // FIXME should list allowed characters instead - return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app); + /* Only lowercase alphanumeric is allowed */ + return preg_replace('/[^a-z0-9_]+/', '', $app); } } diff --git a/lib/public/App/IAppManager.php b/lib/public/App/IAppManager.php index 961823dee6e..fa35819b779 100644 --- a/lib/public/App/IAppManager.php +++ b/lib/public/App/IAppManager.php @@ -309,10 +309,17 @@ interface IAppManager { /** * Clean the appId from forbidden characters * + * @psalm-taint-escape callable + * @psalm-taint-escape cookie * @psalm-taint-escape file - * @psalm-taint-escape include - * @psalm-taint-escape html * @psalm-taint-escape has_quotes + * @psalm-taint-escape header + * @psalm-taint-escape html + * @psalm-taint-escape include + * @psalm-taint-escape ldap + * @psalm-taint-escape shell + * @psalm-taint-escape sql + * @psalm-taint-escape unserialize * * @since 31.0.0 */