Skip to content

Fixed incorrect sanitisation of URLs for package installation requests #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tieneupin merged 2 commits into from
Jan 21, 2025
Merged

Fixed incorrect sanitisation of URLs for package installation requests #457

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f3b740
Fixed incorrect sanitisation of URLs for package installation requests
tieneupin Jan 21, 2025
dc63cd0
Missed applying the fix to a few 'quote()' instances
tieneupin Jan 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions src/murfey/server/api/bootstrap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,15 +228,16 @@ def parse_cygwin_request(request_path: str):
"""

# Validate request path
if bool(re.fullmatch(r"^[\w\s\.\-/]+$", request_path)) is False:
if bool(re.fullmatch(r"^[\w\s\.\-\+/]+$", request_path)) is False:
raise ValueError(f"{request_path!r} is not a valid request path")

try:
url = f'{find_cygwin_mirror()}{quote(request_path, safe="")}'
url = f'{find_cygwin_mirror()}{quote(request_path, safe="/")}'
except Exception:
raise HTTPException(
status_code=503, detail="Could not identify a suitable Cygwin mirror"
)

logger.info(f"Forwarding Cygwin download request to {_sanitise_str(url)}")
cygwin_data = requests.get(url)
return Response(
Expand Down Expand Up @@ -434,7 +435,7 @@ def _rewrite_url(match):
raise ValueError(f"{system!r} is not a valid msys2 environment")

# Construct URL to main MSYS repo and get response
arch_url = f'{msys2_url}/{quote(system, safe="")}'
arch_url = f'{msys2_url}/{quote(system, safe="/")}'
response = requests.get(arch_url)

# Parse and rewrite package index content
Expand Down Expand Up @@ -497,7 +498,7 @@ def _rewrite_url(match):

# Construct URL to main MSYS repo and get response
package_list_url = (
f'{msys2_url}/{quote(system, safe="")}/{quote(environment, safe="")}'
f'{msys2_url}/{quote(system, safe="/")}/{quote(environment, safe="/")}'
)
response = requests.get(package_list_url)

Expand Down Expand Up @@ -551,7 +552,7 @@ def get_msys2_package_file(
raise ValueError(f"{package!r} is not a valid package name")

# Construct URL to main MSYS repo and get response
package_url = f'{msys2_url}/{quote(system, safe="")}/{quote(environment, safe="")}/{quote(package, safe="")}'
package_url = f'{msys2_url}/{quote(system, safe="/")}/{quote(environment, safe="/")}/{quote(package, safe="/")}'
package_file = requests.get(package_url)

if package_file.status_code == 200:
Expand Down Expand Up @@ -581,7 +582,7 @@ def _get_full_pypi_path_response(package: str) -> requests.Response:
# alphanumerics (including underscores; \w), dashes (\-), and periods (\.)
if re.match(r"^[\w\-\.]+$", package) is not None:
# Sanitise and normalise package name according to PEP 503
package_clean = quote(re.sub(r"[-_.]+", "-", package.lower()), safe="")
package_clean = quote(re.sub(r"[-_.]+", "-", package.lower()), safe="/")

# Get HTTP response
url = f"https://pypi.org/simple/{package_clean}"
Expand Down