authorgravatar for git@paperclover.netclover caruso <git@paperclover.net> 2026-10-04 23:32:35-07:00
committergravatar for git@paperclover.netclover caruso <git@paperclover.net> 2026-10-05 15:36:02-07:00
log38c39a7c29a8ed78c19e7170d292f76a4f22641b
tree2c43f6346e016b2e86933a50b7ff6859c1b6585d
parentfb0278c62cbe94f2d7874ec12d7a8a33a84b301d
signature Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU

Allow safe path globs for service HTML injection

1 files changed, 1 insertions(+), 1 deletions(-)

tools/router.py+1-1
......@@ -172,7 +172,7 @@ def render(token):
172172 if head_html and (role or headers):
173173 raise ValueError(f"authenticated route has HTML injection: {host}")
174174 for request, markup in head_html.items():
175 if not re.fullmatch(r"/[A-Za-z0-9/._-]*", request) or not markup:
175 if not re.fullmatch(r"/[A-Za-z0-9/._*-]*", request) or not markup:
176176 raise ValueError(f"invalid HTML injection: {host} {request}")
177177 for request, path in assets.get("files", {}).items():
178178 if not request.startswith("/") or " " in request or "\n" in request: