Skip to content

Security Fixes: SQL Injection, Command Injection, SSL Verification #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GuillaumeLeone8 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Security Fixes: SQL Injection, Command Injection, SSL Verification #181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 3 additions & 9 deletions utils/http.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,12 @@ def post(url, body, logger, headers=None, timeout=5) :
}
result = {}

try :
# 消除https警告
requests.packages.urllib3.disable_warnings()
except Exception :
pass

response = None
try :
if headers :
response = requests.post(url, headers=headers, data=json.dumps(body), proxies=proxies, verify=False, timeout=timeout)
response = requests.post(url, headers=headers, data=json.dumps(body), proxies=proxies, verify=True, timeout=timeout)
else :
response = requests.post(url, data=json.dumps(body), proxies=proxies, verify=False, timeout=timeout)
response = requests.post(url, data=json.dumps(body), proxies=proxies, verify=True, timeout=timeout)
try :
response.encoding = "utf-8"
result = json.loads(response.text)
Expand Down Expand Up @@ -100,7 +94,7 @@ def getOCR(url) :
proxies = {"http": None, "https": None}
start = time.time()
try :
res = requests.get(url, proxies=proxies, verify=False, timeout=3)
res = requests.get(url, proxies=proxies, verify=True, timeout=3)
time_diff = time.time() - start
status_code = res.status_code
except Exception :
Expand Down
10 changes: 6 additions & 4 deletions utils/offline_ocr.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import time
import requests
import zipfile
import subprocess

import utils.message
import utils.thread
Expand Down Expand Up @@ -47,10 +48,11 @@ def install_offline_ocr(object) :
def killOfflineOCR(port) :

try :
popen_content = os.popen("netstat -ano |findstr %s"%port).read()
if popen_content :
pid = popen_content.split(" ")[-1]
os.popen("taskkill /f /t /im %s"%pid)
popen_content = subprocess.run(["netstat", "-ano"], capture_output=True, text=True).stdout
lines = [line for line in popen_content.splitlines() if str(port) in line]
if lines:
pid = lines[0].split()[-1]
subprocess.run(["taskkill", "/f", "/t", "/pid", pid], capture_output=True)
except Exception :
return format_exc()

Expand Down
22 changes: 14 additions & 8 deletions utils/sqlite.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,15 +130,18 @@ def selectTranslationDBList(src, tgt, limit, offset, logger) :
try :
if src :
if tgt :
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE src LIKE '%{}%' AND tgt LIKE '%{}%' ORDER BY id DESC LIMIT ? OFFSET ?;'''.format(src, tgt)
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE src LIKE ? AND tgt LIKE ? ORDER BY id DESC LIMIT ? OFFSET ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{src}%', f'%{tgt}%', limit, offset))
else :
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE src LIKE '%{}%' ORDER BY id DESC LIMIT ? OFFSET ?;'''.format(src)
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE src LIKE ? ORDER BY id DESC LIMIT ? OFFSET ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{src}%', limit, offset))
else:
if tgt :
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE tgt LIKE '%{}%' ORDER BY id DESC LIMIT ? OFFSET ?;'''.format(tgt)
sql = '''SELECT id, trans_type, src, tgt FROM translations WHERE tgt LIKE ? ORDER BY id DESC LIMIT ? OFFSET ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{tgt}%', limit, offset))
else :
sql = '''SELECT id, trans_type, src, tgt FROM translations ORDER BY id DESC LIMIT ? OFFSET ?;'''
cursor = TRANSLATION_DB.execute(sql, (limit, offset))
cursor = TRANSLATION_DB.execute(sql, (limit, offset))
rows = cursor.fetchall()
cursor.close()
except Exception :
Expand Down Expand Up @@ -233,15 +236,18 @@ def selectTranslationDBTotal(src, tgt, logger) :
try :
if src :
if tgt :
sql = '''SELECT count(*) FROM translations WHERE src LIKE '%{}%' AND tgt LIKE '%{}%';'''.format(src, tgt)
sql = '''SELECT count(*) FROM translations WHERE src LIKE ? AND tgt LIKE ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{src}%', f'%{tgt}%'))
else :
sql = '''SELECT count(*) FROM translations WHERE src LIKE '%{}%';'''.format(src)
sql = '''SELECT count(*) FROM translations WHERE src LIKE ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{src}%',))
else :
if tgt :
sql = '''SELECT count(*) FROM translations WHERE tgt LIKE '%{}%';'''.format(tgt)
sql = '''SELECT count(*) FROM translations WHERE tgt LIKE ?;'''
cursor = TRANSLATION_DB.execute(sql, (f'%{tgt}%',))
else :
sql = '''SELECT count(*) FROM translations;'''
cursor = TRANSLATION_DB.execute(sql)
cursor = TRANSLATION_DB.execute(sql)
result = cursor.fetchone()[0]
cursor.close()
except Exception :
Expand Down