NPO-Accounting/beancount-tools-in-Perl
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Be exceedingly less strict on the question format.

Browse source 
This may ultimately be a security problem; I wanted to filter the
question for only characters that are valid in bean-query, and at
some point, the right move is to look up what characters in the
bean-query parser that are allowed.  However, I kept running into
problems of finding new characters and this was an easier hack.
This commit is contained in:
Bradley M. Kuhn 2020-09-23 16:45:01 -07:00
parent 72559aa8d6
commit c4e5664bb5
No known key found for this signature in database
GPG key ID: F15E8BD6D05E26B3
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
bean-query-goofy-daemon.plx
View file

@ -184,7 +184,8 @@ while (1) {
print STDERR "sleep for 2 seconds\n" if $VERBOSE > 5; print STDERR "sleep for 2 seconds\n" if $VERBOSE > 5;
sleep 2; sleep 2;
next; next;
} elsif ($query{question} !~ /^[\,\=\~\-\@\w.\s\"\'\_\(\)\<\>\*\.\!]+$/) { # } elsif ($query{question} !~ /^[\,\=\~\-\@\w.\s\"\'\_\(\)\<\>\*\.\!\^\:\$\|]+$/) {
} elsif ($query{question} !~ /^[\s\S]+$/) {
print STDERR "Query string $query{question} looks suspicious, not running beancount query!\n"; print STDERR "Query string $query{question} looks suspicious, not running beancount query!\n";
(tied %query)->shlock; (tied %query)->shlock;
$query{fifoName} = mktemp("REJECTED_beancount-query-fifo-this-file-does-not-exist_${$}_XXXXXXXXX"); $query{fifoName} = mktemp("REJECTED_beancount-query-fifo-this-file-does-not-exist_${$}_XXXXXXXXX");