From 59da0d34f4e5bcc2227820120726f0bba0806d6a Mon Sep 17 00:00:00 2001 From: Russell Ballestrini Date: Fri, 13 Dec 2024 18:00:59 -0500 Subject: [PATCH] grrrrrr request next spammer --- make_post_sell/request_methods.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/make_post_sell/request_methods.py b/make_post_sell/request_methods.py index 93522a0..f35872f 100644 --- a/make_post_sell/request_methods.py +++ b/make_post_sell/request_methods.py @@ -109,19 +109,18 @@ def includeme(config): import re from pyramid.httpexceptions import HTTPUnauthorized - # Allow one unescaped "next=" but block multiple or any escaped forms query_string = request.query_string - # Check for exact "next=" (case insensitive) + # Check for double or nested "next=" patterns unescaped_next_count = len(re.findall(r"(?i)\bnext=", query_string)) + escaped_next_count = len( + re.findall(r"(?i)\bnext%25|next%3D|next%253D|next%2525", query_string) + ) - # Check for escaped versions (case insensitive) - escaped_next_match = re.search(r"(?i)next%25|next%3D", query_string) - - if unescaped_next_count > 1 or escaped_next_match: + if unescaped_next_count + escaped_next_count > 1: print( f"Blocked spam request from {request.remote_addr}: " - f"Multiple or escaped 'next=' patterns detected." + f"Multiple or nested 'next=' patterns detected." ) return HTTPUnauthorized("Request appears malformed or spammy.")