search

XCSoar / xcsoar-data-repository

XCSoar File Manager Data Repository
https://download.xcsoar.org/repository
8 stars 23 forks source link

Incorrect labels for NAME in Czech and Polish Wave airspace / Check for invalid chars #220

Closed lordfolken closed 2 years ago

lordfolken commented 2 years ago

https://github.com/XCSoar/xcsoar-data-repository/blob/3a808b31cc2850c48b9c397d78e008aa6a7b6fe1/data/airspace-special.json#L12

As the NAME tag is actually the destination filename. We should check for a correct file extension. In the openair airspace case its .txt.

Downloading the file works, and if you do it via the settings profile, it will actually select the file. However if the airspace file list is used, the file will never show up due to the missing extension.

A further thing to check is for things that could be interpreted as a directory traversal: (.. or / )

lordfolken commented 2 years ago

@elgandoz

elgandoz commented 2 years ago

Maybe we could add in the test script a check for a valid filename with a .txt extension? I can have a look into it.

lordfolken commented 2 years ago

@csindle has been doing some work on this. (The plan is to replace the xcsoar-data-repository with xcsoar-data-content and handle everything from there see: https://github.com/XCSoar/xcsoar-data-content/issues/180) His checks could be extended to parse the filenames: https://github.com/XCSoar/xcsoar-data-content/blob/master/scripts/check_urls.py

elgandoz commented 2 years ago

I'm a bit lost about the 2 repos (data-repository vs data-content) and also I'm not an expert in python, but I drafted a quick extra check in js for this repo, see #222. It requires this issue to be sorted/merged first.