upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix: Only keep allowed characters in appid, and flag the method as escaping

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2025-02-13 14:21:36 +01:00 committed by Andy Scherzinger
parent 08e3e213d3
commit adf5b72939
2 changed files with 26 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
lib/private/App/AppManager.php
View file

@ -926,8 +926,23 @@ class AppManager implements IAppManager {
return false;
}
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*/
public function cleanAppId(string $app): string {
// FIXME should list allowed characters instead
return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app);
/* Only lowercase alphanumeric is allowed */
return preg_replace('/[^a-z0-9_]+/', '', $app);
}
}

11
lib/public/App/IAppManager.php
View file

@ -292,10 +292,17 @@ interface IAppManager {
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape include
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*
* @since 31.0.0
*/