mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-11-08 08:20:28 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

VercodeOperation: only allow simple math expresssions and %c

Browse source
This commit is contained in:
Hans-Christoph Steiner 2018-03-02 12:50:48 +01:00
parent 6876e28bb4
commit 8f30c892c5
4 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fdroidserver/checkupdates.py
View file

@ -429,6 +429,9 @@ def checkupdates_app(app):
msg = 'Invalid update check method'
if version and vercode and app.VercodeOperation:
if not common.VERCODE_OPERATION_RE.match(app.VercodeOperation):
raise MetaDataException(_('Invalid VercodeOperation: {field}')
.format(field=app.VercodeOperation))
oldvercode = str(int(vercode))
op = app.VercodeOperation.replace("%c", oldvercode)
vercode = str(eval(op))

2
fdroidserver/common.py
View file

@ -61,6 +61,8 @@ from .asynchronousfilereader import AsynchronousFileReader
# has to be manually set in test_aapt_version()
MINIMUM_AAPT_VERSION = '26.0.0'
VERCODE_OPERATION_RE = re.compile(r'^([ 0-9/*+-]|%c)+$')
# A signature block file with a .DSA, .RSA, or .EC extension
CERT_PATH_REGEX = re.compile(r'^META-INF/.*\.(DSA|EC|RSA)$')
APK_NAME_REGEX = re.compile(r'^([a-zA-Z][\w.]*)_(-?[0-9]+)_?([0-9a-f]{7})?\.apk')

6
fdroidserver/lint.py
View file

@ -222,6 +222,11 @@ def check_update_check_data_url(app):
yield _('UpdateCheckData must use HTTPS URL: {url}').format(url=url)
def check_vercode_operation(app):
if app.VercodeOperation and not common.VERCODE_OPERATION_RE.match(app.VercodeOperation):
yield _('Invalid VercodeOperation: {field}').format(field=app.VercodeOperation)
def check_ucm_tags(app):
lastbuild = get_lastbuild(app.builds)
if (lastbuild is not None
@ -529,6 +534,7 @@ def main():
app_check_funcs = [
check_regexes,
check_update_check_data_url,
check_vercode_operation,
check_ucm_tags,
check_char_limits,
check_old_links,