diff options
Diffstat (limited to 'lib/mat.py')
| -rw-r--r-- | lib/mat.py | 9 |
1 files changed, 3 insertions, 6 deletions
| @@ -31,20 +31,17 @@ def is_secure(filename): | |||
| 31 | ''' | 31 | ''' |
| 32 | Prevent shell injection | 32 | Prevent shell injection |
| 33 | ''' | 33 | ''' |
| 34 | if not(os.path.isfile(name)): #check if the file exist | 34 | |
| 35 | if not(os.path.isfile(filename)): #check if the file exist | ||
| 35 | print("Error: %s is not a valid file" % name) | 36 | print("Error: %s is not a valid file" % name) |
| 36 | sys.exit(1) | 37 | sys.exit(1) |
| 37 | filename.strip('\s') #separations | ||
| 38 | filename.strip('`') #injection `rm / -Rf` | ||
| 39 | filename.strip('\$(.*)')#injection $(rm / -Rf) | ||
| 40 | filename.strip(';')#injection $filename;rm / -Rf | ||
| 41 | 38 | ||
| 42 | def create_class_file(name, backup): | 39 | def create_class_file(name, backup): |
| 43 | ''' | 40 | ''' |
| 44 | return a $FILETYPEStripper() class, | 41 | return a $FILETYPEStripper() class, |
| 45 | corresponding to the filetype of the given file | 42 | corresponding to the filetype of the given file |
| 46 | ''' | 43 | ''' |
| 47 | #is_secure(name) | 44 | is_secure(name) |
| 48 | 45 | ||
| 49 | filename = "" | 46 | filename = "" |
| 50 | realname = name | 47 | realname = name |
