reject usernames that contain dots at the Empretienda AR probe#3015
Open
HrachShah wants to merge 1 commit into
Open
reject usernames that contain dots at the Empretienda AR probe#3015HrachShah wants to merge 1 commit into
HrachShah wants to merge 1 commit into
Conversation
The url pattern for Empretienda AR embeds the username as a subdomain
of empretienda.com.ar ("https://{}.empretienda.com.ar"). A username
that contains a period, e.g. "alice.", is interpolated into the host
of the request, producing a URL like
https://alice..empretienda.com.ar
The intermediate double dot is not a valid DNS label separator, so
urllib3 raises LocationParseError from the adapter and the whole
sherlock run aborts with a traceback pointing at create_connection
instead of skipping the broken site.
Add a regexCheck that matches the same character class as the other
subdomain-style entries already in the manifest (booth.pm, blogspot.com,
carbonmade.com, crevado.com, exposure.co, etc.), namely ^[\w@-]+?$.
That accepts the usernames Empretienda actually issues (letters,
digits, underscores, hyphens, at-signs) and rejects any with dots or
other characters that would corrupt the host part of the interpolated
URL. The skip path is QueryStatus.ILLEGAL, the same as the other
sites that use this regex, and the run continues past the
problematic username.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2970.
The url pattern for Empretienda AR embeds the username as a subdomain of empretienda.com.ar (
https://{}.empretienda.com.ar). A username that contains a period, e.g.alice., is interpolated into the host of the request, producing a URL likeThe intermediate double dot is not a valid DNS label separator, so urllib3 raises
LocationParseErrorfrom the adapter and the wholesherlockrun aborts with a traceback pointing atcreate_connectioninstead of skipping the broken site.Fix: add a
regexCheckthat matches the same character class as the other subdomain-style entries already in the manifest (booth.pm,blogspot.com,carbonmade.com,crevado.com,exposure.co, etc.), namely^[\\w@-]+?$. That accepts the usernames Empretienda actually issues (letters, digits, underscores, hyphens, at-signs) and rejects any with dots or other characters that would corrupt the host part of the interpolated URL. The skip path isQueryStatus.ILLEGAL, the same as the other sites that use this regex, and the run continues past the problematic username.Verified locally that
test_validate_manifest_against_local_schemastill passes; the rest of the regex behaviour can be exercised against any of the existingtest_username_illegal_regex-style probes.