diff options
| author | Côme Chilliet <come.chilliet@nextcloud.com> | 2025-02-13 14:21:36 +0100 |
|---|---|---|
| committer | Andy Scherzinger <info@andy-scherzinger.de> | 2025-02-19 18:39:20 +0100 |
| commit | adf5b729395e0a6c1f779665c5da11a6d0d88fbf (patch) | |
| tree | c296e7d39cb09939b3a874ef14471aa5f936caae | |
| parent | 08e3e213d35f45a1884f69a448c4c555640ad5e9 (diff) | |
| download | nextcloud-server-adf5b729395e0a6c1f779665c5da11a6d0d88fbf.tar.gz nextcloud-server-adf5b729395e0a6c1f779665c5da11a6d0d88fbf.zip | |
fix: Only keep allowed characters in appid, and flag the method as escaping
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
| -rw-r--r-- | lib/private/App/AppManager.php | 19 | ||||
| -rw-r--r-- | lib/public/App/IAppManager.php | 11 |
2 files changed, 26 insertions, 4 deletions
diff --git a/lib/private/App/AppManager.php b/lib/private/App/AppManager.php index b6f7f9b13b7..3f2e31f08ee 100644 --- a/lib/private/App/AppManager.php +++ b/lib/private/App/AppManager.php @@ -926,8 +926,23 @@ class AppManager implements IAppManager { return false; } + /** + * Clean the appId from forbidden characters + * + * @psalm-taint-escape callable + * @psalm-taint-escape cookie + * @psalm-taint-escape file + * @psalm-taint-escape has_quotes + * @psalm-taint-escape header + * @psalm-taint-escape html + * @psalm-taint-escape include + * @psalm-taint-escape ldap + * @psalm-taint-escape shell + * @psalm-taint-escape sql + * @psalm-taint-escape unserialize + */ public function cleanAppId(string $app): string { - // FIXME should list allowed characters instead - return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app); + /* Only lowercase alphanumeric is allowed */ + return preg_replace('/[^a-z0-9_]+/', '', $app); } } diff --git a/lib/public/App/IAppManager.php b/lib/public/App/IAppManager.php index 110bcacf396..f16b188e6b6 100644 --- a/lib/public/App/IAppManager.php +++ b/lib/public/App/IAppManager.php @@ -292,10 +292,17 @@ interface IAppManager { /** * Clean the appId from forbidden characters * + * @psalm-taint-escape callable + * @psalm-taint-escape cookie * @psalm-taint-escape file - * @psalm-taint-escape include - * @psalm-taint-escape html * @psalm-taint-escape has_quotes + * @psalm-taint-escape header + * @psalm-taint-escape html + * @psalm-taint-escape include + * @psalm-taint-escape ldap + * @psalm-taint-escape shell + * @psalm-taint-escape sql + * @psalm-taint-escape unserialize * * @since 31.0.0 */ |