carpathianflorist
/
MarseyWorld
forked from MarseyWorld/MarseyWorld
1
0
Fork 0
Code Pull Requests Activity

disable browser-killing exploit

master
Aevann 2023-05-05 03:07:25 +03:00
parent 49ce8617f2
commit 6a7fc72e7c
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
files/helpers/sanitize.py
View File

@ -354,6 +354,10 @@ def sanitize(sanitized, golden=True, limit_pings=0, showmore=True, count_emojis=
sanitized = sanitized.strip() sanitized = sanitized.strip()
if not sanitized: return '' if not sanitized: return ''
if "style" in sanitized and "filter" in sanitized:
if sanitized.count("blur(") + sanitized.count("drop-shadow(") > 5:
abort(400, "Too many filters!")
if blackjack and execute_blackjack(g.v, None, sanitized, blackjack): if blackjack and execute_blackjack(g.v, None, sanitized, blackjack):
sanitized = 'g' sanitized = 'g'