Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape detected songs before using as regex #17

Open
johntyree opened this issue Apr 15, 2014 · 3 comments
Open

Escape detected songs before using as regex #17

johntyree opened this issue Apr 15, 2014 · 3 comments
Labels

Comments

@johntyree
Copy link
Owner

Strange song info can turn out to be a malformed (malicious) regex.

@luqmaan
Copy link

luqmaan commented Apr 17, 2014

Example of that 💩?

@johntyree
Copy link
Owner Author

Yeah so the song that crashed everything had an imcomplete title in the ICYINFO coming down from the server. I don't have the exact string now, but it was something along the lines of

Rad Artist - Rad Song (Remix feat. Other Ar

If you try to compile that as a regex, you'll throw an sre_constants.error: unbalanced parenthesis.

@johntyree
Copy link
Owner Author

I say (malicious) because it's not sanitized whatsoever. If there's anyway to get the regex compiler to freak out by sending a specially designed string down the pipe then it will explode.

@johntyree johntyree added the bug label May 19, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants