sanitized gen_ajax words

No sanitization of the "words" parameter was done. This would allow somebody to request a billion words, possibly consuming all the available RAM in the system.
robertdavidgraham · Oct 30, 2013 · cc1314f199cb42f4fe19bd6efc4e327873498ccf · cc1314f
1 parent 05f52ec
commit cc1314f199cb42f4fe19bd6efc4e327873498ccf
Unified Split

Showing with 2 additions and 0 deletions.

+2 −0 modules/deaddrop/files/deaddrop/source.py
diff --git a/modules/deaddrop/files/deaddrop/source.py b/modules/deaddrop/files/deaddrop/source.py
@@ -42,6 +42,8 @@ def GET(self):
    request_params = web.input()
    if 'words' in request_params:
      word_num = int(request_params['words'])
+      if (word_num not in range(4, 11)):
+        raise web.notfound()
      uid = crypto.genrandomid(word_num)
      return json.dumps({'result': 'success', 'id': uid})
    else: