From 9ca4f448d8b45a8bac48a0818412e0fc5fbce0ad Mon Sep 17 00:00:00 2001 From: Mawoka Date: Tue, 26 Apr 2022 17:15:59 +0200 Subject: [PATCH] :lock: Escaping server-url --- classquiz/routers/quiz.py | 4 ++-- run_tests.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/classquiz/routers/quiz.py b/classquiz/routers/quiz.py index 7056f1b..46b6f8a 100644 --- a/classquiz/routers/quiz.py +++ b/classquiz/routers/quiz.py @@ -23,7 +23,7 @@ router = APIRouter() @router.post("/create") async def create_quiz_lol(quiz_input: QuizInput, user: User = Depends(get_current_user)): imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$" - server_regex = rf"^{settings.root_address}/api/v1/storage/download/.{36}--.{36}$" + server_regex = rf"^{re.escape(settings.root_address)}/api/v1/storage/download/.{36}--.{36}$" quiz_input.title = html.unescape(bleach.clean(quiz_input.title, tags=[], strip=True)) quiz_input.description = html.unescape(bleach.clean(quiz_input.description, tags=[], strip=True)) for question in quiz_input.questions: @@ -116,7 +116,7 @@ async def get_quiz_list(user: User = Depends(get_current_user)): @router.put("/update/{quiz_id}") async def update_quiz(quiz_id: str, quiz_input: QuizInput, user: User = Depends(get_current_user)): imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$" - server_regex = rf"^{settings.root_address}/api/v1/storage/download/.{{36}}--.{{36}}$" + server_regex = rf"^{re.escape(settings.root_address)}/api/v1/storage/download/.{{36}}--.{{36}}$" for question in quiz_input.questions: if question.image == "": question.image = None diff --git a/run_tests.sh b/run_tests.sh index 1edf4a6..27928bd 100755 --- a/run_tests.sh +++ b/run_tests.sh @@ -9,7 +9,6 @@ stop() { init() { mkdir /tmp/storage - rm classquiz.db docker run --rm -d -p 6379:6379 --name test_redis redis:alpine docker run -it --rm -d -p 7700:7700 --name test_meili getmeili/meilisearch:latest pipenv run python3 init_db.py @@ -19,6 +18,7 @@ case $1 in +) init ;; -) stop ;; a) + rm classquiz.db init run_tests stop