Uncontrolled command line

openeduhub / metalookup

Provide metadata about domains w.r.t accessibility, licencing, adds, etc.

GNU General Public License v3.0

5 stars 0 forks source link

Uncontrolled command line #139

Closed MRuecklCC closed 2 years ago

MRuecklCC commented 2 years ago

Tracking issue for:

[ ] https://github.com/openeduhub/metalookup/security/code-scanning/2

MRuecklCC commented 2 years ago

This should be fixable, by turning the input URL from str to HttpUrl, essentialy prohibiting arbitrary command line inputs.

MRuecklCC commented 2 years ago

While the initially reported problem is fixed, the current approach can still be exploited by providing invalid strategy or category values funny enough, those were not detected by the code quality scan.