From e7f4ef8a09a2a5e3b846c46a2e9cbede57e13de0 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Fri, 23 Nov 2018 14:43:08 -0500 Subject: [PATCH 1/2] Prevent domains sent to queryAds acting as command line options Signed-off-by: Mcat12 --- scripts/pi-hole/php/queryads.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/pi-hole/php/queryads.php b/scripts/pi-hole/php/queryads.php index 0de64cb0..fb051488 100644 --- a/scripts/pi-hole/php/queryads.php +++ b/scripts/pi-hole/php/queryads.php @@ -23,7 +23,8 @@ function echoEvent($datatext) { ini_set("pcre.recursion_limit", 1500); function is_valid_domain_name($domain_name) { - return (preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check + return (preg_match("/^-/", $domain_name) !== 1 // Don't allow domains to appear as command line options + && preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check && preg_match("/^.{1,253}$/", $domain_name) // Overall length check && preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name) ); // Length of each label } From 9d4e54559348c6c47d5797580606d0b6884d1bd0 Mon Sep 17 00:00:00 2001 From: Mark Drobnak Date: Sat, 24 Nov 2018 11:21:54 -0500 Subject: [PATCH 2/2] Use simpler check for dash in is_valid_domain_name Signed-off-by: Mark Drobnak --- scripts/pi-hole/php/queryads.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/pi-hole/php/queryads.php b/scripts/pi-hole/php/queryads.php index fb051488..65eabcec 100644 --- a/scripts/pi-hole/php/queryads.php +++ b/scripts/pi-hole/php/queryads.php @@ -23,7 +23,7 @@ function echoEvent($datatext) { ini_set("pcre.recursion_limit", 1500); function is_valid_domain_name($domain_name) { - return (preg_match("/^-/", $domain_name) !== 1 // Don't allow domains to appear as command line options + return ($domain_name[0] !== '-' // Don't allow domains to appear as command line options && preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check && preg_match("/^.{1,253}$/", $domain_name) // Overall length check && preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name) ); // Length of each label