From e7f4ef8a09a2a5e3b846c46a2e9cbede57e13de0 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 23 Nov 2018 14:43:08 -0500
Subject: [PATCH] Prevent domains sent to queryAds acting as command line
 options

Signed-off-by: Mcat12 <newtoncat12@yahoo.com>
---
 scripts/pi-hole/php/queryads.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/pi-hole/php/queryads.php b/scripts/pi-hole/php/queryads.php
index 0de64cb0..fb051488 100644
--- a/scripts/pi-hole/php/queryads.php
+++ b/scripts/pi-hole/php/queryads.php
@@ -23,7 +23,8 @@ function echoEvent($datatext) {
 ini_set("pcre.recursion_limit", 1500);
 function is_valid_domain_name($domain_name)
 {
-    return (preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check
+    return (preg_match("/^-/", $domain_name) !== 1 // Don't allow domains to appear as command line options
+            && preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check
             && preg_match("/^.{1,253}$/", $domain_name) // Overall length check
             && preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name)   ); // Length of each label
 }