upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

Merge pull request #50794 from nextcloud/fix/fix-appmanager-cleanappid

Browse source 
fix: Only keep allowed characters in appid, and flag the method as escaping
This commit is contained in:
Côme Chilliet 2025-02-13 17:23:44 +01:00 committed by GitHub
commit b003af2364
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 26 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
lib/private/App/AppManager.php
View file

@ -939,8 +939,23 @@ class AppManager implements IAppManager {
return false;
}
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*/
public function cleanAppId(string $app): string {
// FIXME should list allowed characters instead
return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app);
/* Only lowercase alphanumeric is allowed */
return preg_replace('/(^[0-9_]|[^a-z0-9_]+|_$)/', '', $app);
}
}

11
lib/public/App/IAppManager.php
View file

@ -309,10 +309,17 @@ interface IAppManager {
/**
* Clean the appId from forbidden characters
*
* @psalm-taint-escape callable
* @psalm-taint-escape cookie
* @psalm-taint-escape file
* @psalm-taint-escape include
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
* @psalm-taint-escape header
* @psalm-taint-escape html
* @psalm-taint-escape include
* @psalm-taint-escape ldap
* @psalm-taint-escape shell
* @psalm-taint-escape sql
* @psalm-taint-escape unserialize
*
* @since 31.0.0
*/