cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-07-20 04:26:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a vulnerability introduced by the Request Music PR (#75691)

Browse Source 
Admins can proccall the web_sound proc, completely bypassing the
shell_url_scrub done in other procs. Additionally, admins could just
directly modify the request URL stored in the request manager so that
it, again, bypasses the shell_url_scrub.

This PR just moves the shell scrubbing directly inside the proc, right
before the world.shelleo call, so that admins can't get around it with a
proccall.
This commit is contained in:
Watermelon914
2023-05-27 18:30:16 +01:00
committed by GitHub
parent 7bafed4bf6
commit dc64f47f98
2 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/verbs/playsound.dm
+3 -4
View File
@@ -82,9 +82,9 @@
var/stop_web_sounds = FALSE
var/list/music_extra_data = list()
var/duration = 0
if(istext(input))
var/list/output = world.shelleo("[ytdl] --geo-bypass --format \"bestaudio\[ext=mp3]/best\[ext=mp4]\[height <= 360]/bestaudio\[ext=m4a]/bestaudio\[ext=aac]\" --dump-single-json --no-playlist -- \"[input]\"")
var/shell_scrubbed_input = shell_url_scrub(input)
var/list/output = world.shelleo("[ytdl] --geo-bypass --format \"bestaudio\[ext=mp3]/best\[ext=mp4]\[height <= 360]/bestaudio\[ext=m4a]/bestaudio\[ext=aac]\" --dump-single-json --no-playlist -- \"[shell_scrubbed_input]\"")
var/errorlevel = output[SHELLEO_ERRORLEVEL]
var/stdout = output[SHELLEO_STDOUT]
var/stderr = output[SHELLEO_STDERR]
@@ -192,8 +192,7 @@
to_chat(src, span_boldwarning("Non-http(s) URIs are not allowed."), confidential = TRUE)
to_chat(src, span_warning("For youtube-dl shortcuts like ytsearch: please use the appropriate full URL from the website."), confidential = TRUE)
return
var/shell_scrubbed_input = shell_url_scrub(web_sound_input)
web_sound(usr, shell_scrubbed_input)
web_sound(usr, web_sound_input)
else
web_sound(usr, null)
code/modules/admin/verbs/request_internet_sound.dm
-1
View File
@@ -20,7 +20,6 @@
to_chat(usr, span_danger("Invalid URL. Please use a URL from one of the following sites: [replacetext(CONFIG_GET(string/request_internet_allowed), "\\", "")]"), confidential = TRUE)
return
request_url = shell_url_scrub(request_url)
log_internet_request("[src.key]/([src.name]): [request_url]")
if(usr.client)
if(usr.client.prefs.muted & MUTE_INTERNET_REQUEST)