jandieman/searxng
2
0
Fork 0
mirror of https://github.com/searxng/searxng.git synced 2026-08-29 18:41:31 +00:00
Code Issues Projects Releases Wiki Activity

[fix] preferences: cap zlib decompress

Browse Source
This commit is contained in:
vojkovic
2026-08-20 14:54:12 +00:00
committed by Brock Vojkovic
parent 487d7a96e0
commit 5f4005996e
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
searx/preferences.py
View File

@@ -6,7 +6,7 @@
import typing as t import typing as t
from base64 import urlsafe_b64encode, urlsafe_b64decode from base64 import urlsafe_b64encode, urlsafe_b64decode
from zlib import compress, decompress from zlib import compress, decompressobj
from urllib.parse import parse_qs, urlencode from urllib.parse import parse_qs, urlencode
from collections import OrderedDict from collections import OrderedDict
from collections.abc import Iterable from collections.abc import Iterable
@@ -517,7 +517,7 @@ class Preferences:
def parse_encoded_data(self, input_data: str): def parse_encoded_data(self, input_data: str):
"""parse (base64) preferences from request (``flask.request.form['preferences']``)""" """parse (base64) preferences from request (``flask.request.form['preferences']``)"""
bin_data = decompress(urlsafe_b64decode(input_data)) bin_data = decompressobj().decompress(urlsafe_b64decode(input_data), 16 * 1024)
dict_data = {} dict_data = {}
for x, y in parse_qs(bin_data.decode('ascii'), keep_blank_values=True).items(): for x, y in parse_qs(bin_data.decode('ascii'), keep_blank_values=True).items():
dict_data[x] = y[0] dict_data[x] = y[0]

14
searx/webapp.py
View File

@@ -484,14 +484,14 @@ def pre_request():
if k not in sxng_request.form: if k not in sxng_request.form:
sxng_request.form[k] = v sxng_request.form[k] = v
if sxng_request.form.get('preferences'): try:
preferences.parse_encoded_data(sxng_request.form['preferences']) if sxng_request.form.get('preferences'):
else: preferences.parse_encoded_data(sxng_request.form['preferences'])
try: else:
preferences.parse_dict(sxng_request.form) preferences.parse_dict(sxng_request.form)
except Exception as e: # pylint: disable=broad-except except Exception as e: # pylint: disable=broad-except
logger.exception(e, exc_info=True) logger.exception(e, exc_info=True)
sxng_request.errors.append(gettext('Invalid settings')) sxng_request.errors.append(gettext('Invalid settings'))
# language is defined neither in settings nor in preferences # language is defined neither in settings nor in preferences
# use browser headers # use browser headers