mirror_maker/fedi-block-api
1
0
Fork 0
mirror of https://git.kiwifarms.net/mint/fedi-block-api.git synced 2024-10-22 21:39:05 +00:00
Code Issues Projects Releases Packages Wiki Activity

Prevent single-character search DoS

Browse source
This commit is contained in:
Mint 2022-11-27 23:02:12 +03:00
parent 8782880b04
commit 33a3c455e0
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
api.py
View file

@ -34,7 +34,7 @@ def info():
def blocked(domain: str = None, reason: str = None):
if domain == None and reason == None:
raise HTTPException(status_code=400, detail="No filter specified")
conn = sqlite3.connect("blocks.db")
if domain == None and reason == None:
c = conn.cursor()
if domain != None:
wildchar = "*." + ".".join(domain.split(".")[-domain.count("."):])
@ -42,7 +42,10 @@ def blocked(domain: str = None, reason: str = None):
c.execute("select blocker, blocked, block_level, reason from blocks where blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ? or blocked = ?",
(domain, "*." + domain, wildchar, get_hash(domain), punycode, "*." + punycode))
else:
c.execute("select blocker, blocked, reason, block_level from blocks where reason like ? and reason != ''", ("%"+reason+"%",))
if len(reason) < 3:
raise HTTPException(status_code=400, detail="Keyword is shorter than three characters")
else:
c.execute("select blocker, blocked, reason, block_level from blocks where reason like ? and reason != ''", ("%"+reason+"%",))
blocks = c.fetchall()
conn.close()