Skip to content

E
eterban
Commit ff37b349 authored by Vitaly Lipatov's avatar Vitaly Lipatov
Browse files
Options

internal: escape user-controlled ban page output

parent 98913454
Hide whitespace changes
Inline Side-by-side
Showing with 8 additions and 7 deletions
ban-internal-server/data/www/int2.py
View file @ ff37b349
import socket import socket
import struct import struct
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from html import escape
from urllib.parse import quote, parse_qs, urlparse
import redis import redis
import configparser import configparser
...@@ -44,9 +46,8 @@ class OriginalDstHandler(BaseHTTPRequestHandler): ...@@ -44,9 +46,8 @@ class OriginalDstHandler(BaseHTTPRequestHandler):
# Обработка запроса на разблокировку # Обработка запроса на разблокировку
if self.path.startswith("/unban"): if self.path.startswith("/unban"):
# Извлекаем IP из параметра запроса # Извлекаем IP из параметра запроса
import urllib.parse query = urlparse(self.path).query
query = urllib.parse.urlparse(self.path).query params = parse_qs(query)
params = urllib.parse.parse_qs(query)
target_ip = params.get("ip", [None])[0] target_ip = params.get("ip", [None])[0]
...@@ -90,7 +91,7 @@ class OriginalDstHandler(BaseHTTPRequestHandler): ...@@ -90,7 +91,7 @@ class OriginalDstHandler(BaseHTTPRequestHandler):
<html> <html>
<head><title>Unban IP</title></head> <head><title>Unban IP</title></head>
<body> <body>
<p>IP {ip} has been unblocked. Wait 5 seconds, please.</p> <p>IP {escape(ip)} has been unblocked. Wait 5 seconds, please.</p>
<script> <script>
function update() {{ function update() {{
window.location.href = "/"; window.location.href = "/";
...@@ -116,10 +117,10 @@ class OriginalDstHandler(BaseHTTPRequestHandler): ...@@ -116,10 +117,10 @@ class OriginalDstHandler(BaseHTTPRequestHandler):
<body> <body>
<h2>Eterban note.</h2> <h2>Eterban note.</h2>
<h3>Access to this IP address is restricted due to it suspicious activity.</h3> <h3>Access to this IP address is restricted due to it suspicious activity.</h3>
<p>You accessed: <strong>{ip}</strong> from your IP {client_ip}</p> <p>You accessed: <strong>{escape(ip)}</strong> from your IP {escape(client_ip)}</p>
<p> <p>
<a href="/unban.php?ip={ip}"> <a href="/unban.php?ip={quote(ip, safe='')}">
<button>Unban IP: {ip}</button> <button>Unban IP: {escape(ip)}</button>
</a> </a>
</p> </p>
</body> </body>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment