From 9e0eb033840087841866ddd061ebbb23704ba7f7 Mon Sep 17 00:00:00 2001 From: Russell Ballestrini Date: Fri, 13 Dec 2024 08:01:29 -0500 Subject: [PATCH] next spam. modified: make_post_sell/request_methods.py --- make_post_sell/request_methods.py | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/make_post_sell/request_methods.py b/make_post_sell/request_methods.py index e52ae31..93522a0 100644 --- a/make_post_sell/request_methods.py +++ b/make_post_sell/request_methods.py @@ -109,14 +109,19 @@ def includeme(config): import re from pyramid.httpexceptions import HTTPUnauthorized - # Regex to detect nested encoded 'next=' patterns - next_pattern = re.compile(r"(next(?:%25|%3D))+", re.IGNORECASE) - matches = next_pattern.findall(request.query_string) + # Allow one unescaped "next=" but block multiple or any escaped forms + query_string = request.query_string - if len(matches) > 1: + # Check for exact "next=" (case insensitive) + unescaped_next_count = len(re.findall(r"(?i)\bnext=", query_string)) + + # Check for escaped versions (case insensitive) + escaped_next_match = re.search(r"(?i)next%25|next%3D", query_string) + + if unescaped_next_count > 1 or escaped_next_match: print( f"Blocked spam request from {request.remote_addr}: " - f"Multiple encoded 'next=' patterns detected." + f"Multiple or escaped 'next=' patterns detected." ) return HTTPUnauthorized("Request appears malformed or spammy.")