fujin/rtorrent
1
0
Fork 0
mirror of https://github.com/rakshasa/rtorrent.git synced 2026-08-11 12:42:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address review: tighten untrusted safelist and remove set_trusted

Browse Source
This commit is contained in:
Xirvik
2026-03-03 16:56:33 +00:00
committed by Jari Sundell
parent d935e0ffe9
commit 9f6731b4e2
4 changed files with 4 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/command_download.cc
-30
View File
@@ -894,9 +894,7 @@ initialize_command_download() {
rpc::rpc.mark_safe("d.base_filename");
rpc::rpc.mark_safe("d.name");
rpc::rpc.mark_safe("d.directory");
rpc::rpc.mark_safe("d.directory.set");
rpc::rpc.mark_safe("d.directory_base");
rpc::rpc.mark_safe("d.directory_base.set");
rpc::rpc.mark_safe("d.creation_date");
rpc::rpc.mark_safe("d.load_date");
rpc::rpc.mark_safe("d.up.rate");
@@ -916,7 +914,6 @@ initialize_command_download() {
rpc::rpc.mark_safe("d.is_not_partially_done");
rpc::rpc.mark_safe("d.is_meta");
rpc::rpc.mark_safe("d.peer_exchange");
rpc::rpc.mark_safe("d.peer_exchange.set");
rpc::rpc.mark_safe("d.resume");
rpc::rpc.mark_safe("d.pause");
rpc::rpc.mark_safe("d.open");
@@ -928,20 +925,11 @@ initialize_command_download() {
rpc::rpc.mark_safe("d.save_full_session");
rpc::rpc.mark_safe("d.update_priorities");
rpc::rpc.mark_safe("d.custom");
rpc::rpc.mark_safe("d.custom.set");
rpc::rpc.mark_safe("d.custom1");
rpc::rpc.mark_safe("d.custom1.set");
rpc::rpc.mark_safe("d.custom2");
rpc::rpc.mark_safe("d.custom2.set");
rpc::rpc.mark_safe("d.custom3");
rpc::rpc.mark_safe("d.custom3.set");
rpc::rpc.mark_safe("d.custom4");
rpc::rpc.mark_safe("d.custom4.set");
rpc::rpc.mark_safe("d.custom5");
rpc::rpc.mark_safe("d.custom5.set");
rpc::rpc.mark_safe("d.create_link");
rpc::rpc.mark_safe("d.delete_link");
rpc::rpc.mark_safe("d.delete_tied");
rpc::rpc.mark_safe("d.size_bytes");
rpc::rpc.mark_safe("d.size_chunks");
rpc::rpc.mark_safe("d.size_pex");
@@ -950,44 +938,26 @@ initialize_command_download() {
rpc::rpc.mark_safe("d.left_bytes");
rpc::rpc.mark_safe("d.chunk_size");
rpc::rpc.mark_safe("d.priority");
rpc::rpc.mark_safe("d.priority.set");
rpc::rpc.mark_safe("d.priority_str");
rpc::rpc.mark_safe("d.state");
rpc::rpc.mark_safe("d.state.set");
rpc::rpc.mark_safe("d.state_changed");
rpc::rpc.mark_safe("d.state_changed.set");
rpc::rpc.mark_safe("d.state_counter");
rpc::rpc.mark_safe("d.state_counter.set");
rpc::rpc.mark_safe("d.connection_current");
rpc::rpc.mark_safe("d.connection_current.set");
rpc::rpc.mark_safe("d.connection_leech");
rpc::rpc.mark_safe("d.connection_leech.set");
rpc::rpc.mark_safe("d.connection_seed");
rpc::rpc.mark_safe("d.connection_seed.set");
rpc::rpc.mark_safe("d.throttle_name");
rpc::rpc.mark_safe("d.throttle_name.set");
rpc::rpc.mark_safe("d.uploads_max");
rpc::rpc.mark_safe("d.uploads_max.set");
rpc::rpc.mark_safe("d.downloads_max");
rpc::rpc.mark_safe("d.downloads_max.set");
rpc::rpc.mark_safe("d.peers_min");
rpc::rpc.mark_safe("d.peers_min.set");
rpc::rpc.mark_safe("d.peers_max");
rpc::rpc.mark_safe("d.peers_max.set");
rpc::rpc.mark_safe("d.peers_connected");
rpc::rpc.mark_safe("d.peers_not_connected");
rpc::rpc.mark_safe("d.peers_complete");
rpc::rpc.mark_safe("d.tracker_numwant");
rpc::rpc.mark_safe("d.tracker_numwant.set");
rpc::rpc.mark_safe("d.tracker_focus");
rpc::rpc.mark_safe("d.message");
rpc::rpc.mark_safe("d.message.set");
rpc::rpc.mark_safe("d.tied_to_file");
rpc::rpc.mark_safe("d.tied_to_file.set");
rpc::rpc.mark_safe("d.hashing");
rpc::rpc.mark_safe("d.hashing.set");
rpc::rpc.mark_safe("d.hashing_failed");
rpc::rpc.mark_safe("d.hashing_failed.set");
rpc::rpc.mark_safe("d.free_diskspace");
rpc::rpc.mark_safe("d.views");
rpc::rpc.mark_safe("d.views.remove");
src/command_events.cc
-9
View File
@@ -350,15 +350,6 @@ initialize_command_events() {
rpc::rpc.mark_safe("close_untied");
rpc::rpc.mark_safe("remove_untied");
rpc::rpc.mark_safe("load.normal");
rpc::rpc.mark_safe("load.verbose");
rpc::rpc.mark_safe("load.start");
rpc::rpc.mark_safe("load.start_verbose");
rpc::rpc.mark_safe("load.raw");
rpc::rpc.mark_safe("load.raw_verbose");
rpc::rpc.mark_safe("load.raw_start");
rpc::rpc.mark_safe("load.raw_start_verbose");
rpc::rpc.mark_safe("close_low_diskspace");
rpc::rpc.mark_safe("close_low_diskspace.normal");
rpc::rpc.mark_safe("download_list");
src/rpc/rpc_manager.cc
+4 -10
View File
@@ -21,13 +21,6 @@ ExecFile execFile;
// CommandMap::call_command(), which catches all command execution
// including nested calls through argument expansion.
bool
RpcManager::set_trusted(bool trusted) {
bool prev = m_trusted;
m_trusted = trusted;
return prev;
}
bool
RpcManager::is_trusted() const {
return m_trusted;
@@ -146,14 +139,15 @@ RpcManager::process(RPCType type, const char* in_buffer, uint32_t length, slot_r
bool
RpcManager::process_untrusted(RPCType type, const char* in_buffer, uint32_t length, slot_response_callback callback) {
bool previous = set_trusted(false);
bool previous = m_trusted;
m_trusted = false;
try {
bool result = process(type, in_buffer, length, callback);
set_trusted(previous);
m_trusted = previous;
return result;
} catch (...) {
set_trusted(previous);
m_trusted = previous;
throw;
}
}
src/rpc/rpc_manager.h
-1
View File
@@ -83,7 +83,6 @@ public:
// Trusted/untrusted XMLRPC connection model.
// When an SCGI request includes the UNTRUSTED_CONNECTION header,
// commands without flag_untrusted_safe are blocked.
bool set_trusted(bool trusted);
bool is_trusted() const;
static void object_to_target(const torrent::Object& obj, int callFlags, rpc::target_type* target, std::function<void()>* deleter);