From dc64f47f987a765d1e5ce46799a0691b6ee7cd13 Mon Sep 17 00:00:00 2001 From: Watermelon914 <37270891+Watermelon914@users.noreply.github.com> Date: Sat, 27 May 2023 18:30:16 +0100 Subject: [PATCH] Fixed a vulnerability introduced by the Request Music PR (#75691) Admins can proccall the web_sound proc, completely bypassing the shell_url_scrub done in other procs. Additionally, admins could just directly modify the request URL stored in the request manager so that it, again, bypasses the shell_url_scrub. This PR just moves the shell scrubbing directly inside the proc, right before the world.shelleo call, so that admins can't get around it with a proccall. --- code/modules/admin/verbs/playsound.dm | 7 +++---- code/modules/admin/verbs/request_internet_sound.dm | 1 - 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/code/modules/admin/verbs/playsound.dm b/code/modules/admin/verbs/playsound.dm index b2e5de6f81b..7298852f6e5 100644 --- a/code/modules/admin/verbs/playsound.dm +++ b/code/modules/admin/verbs/playsound.dm @@ -82,9 +82,9 @@ var/stop_web_sounds = FALSE var/list/music_extra_data = list() var/duration = 0 - if(istext(input)) - var/list/output = world.shelleo("[ytdl] --geo-bypass --format \"bestaudio\[ext=mp3]/best\[ext=mp4]\[height <= 360]/bestaudio\[ext=m4a]/bestaudio\[ext=aac]\" --dump-single-json --no-playlist -- \"[input]\"") + var/shell_scrubbed_input = shell_url_scrub(input) + var/list/output = world.shelleo("[ytdl] --geo-bypass --format \"bestaudio\[ext=mp3]/best\[ext=mp4]\[height <= 360]/bestaudio\[ext=m4a]/bestaudio\[ext=aac]\" --dump-single-json --no-playlist -- \"[shell_scrubbed_input]\"") var/errorlevel = output[SHELLEO_ERRORLEVEL] var/stdout = output[SHELLEO_STDOUT] var/stderr = output[SHELLEO_STDERR] @@ -192,8 +192,7 @@ to_chat(src, span_boldwarning("Non-http(s) URIs are not allowed."), confidential = TRUE) to_chat(src, span_warning("For youtube-dl shortcuts like ytsearch: please use the appropriate full URL from the website."), confidential = TRUE) return - var/shell_scrubbed_input = shell_url_scrub(web_sound_input) - web_sound(usr, shell_scrubbed_input) + web_sound(usr, web_sound_input) else web_sound(usr, null) diff --git a/code/modules/admin/verbs/request_internet_sound.dm b/code/modules/admin/verbs/request_internet_sound.dm index 934321848f8..0711c2cd169 100644 --- a/code/modules/admin/verbs/request_internet_sound.dm +++ b/code/modules/admin/verbs/request_internet_sound.dm @@ -20,7 +20,6 @@ to_chat(usr, span_danger("Invalid URL. Please use a URL from one of the following sites: [replacetext(CONFIG_GET(string/request_internet_allowed), "\\", "")]"), confidential = TRUE) return - request_url = shell_url_scrub(request_url) log_internet_request("[src.key]/([src.name]): [request_url]") if(usr.client) if(usr.client.prefs.muted & MUTE_INTERNET_REQUEST)