From 6bad7a24be4db00c73ae2b44dbb6bb83a14c0023 Mon Sep 17 00:00:00 2001 From: anupamme Date: Sun, 6 Sep 2026 08:11:30 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- admin/qadmin/assets.py | 23 +++++++++++++++++- .../857908472-linuxq3ademo-1.11-6.x86.gz.sh | Bin 49289300 -> 49288621 bytes 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/admin/qadmin/assets.py b/admin/qadmin/assets.py index dd47bef..afa0b51 100644 --- a/admin/qadmin/assets.py +++ b/admin/qadmin/assets.py @@ -8,15 +8,18 @@ import hashlib import http.cookiejar +import ipaddress import io import json import pathlib import re +import socket import ssl import subprocess import threading import time import urllib.error +import urllib.parse import urllib.request import zipfile import zlib @@ -253,10 +256,28 @@ def cached_usage(): _mirror_down = {} # mirror key -> when it last refused +def _assert_public_url(url): + """Refuse anything but a plain http(s) URL whose host resolves only to + public addresses - blocks SSRF to loopback, link-local (including the + 169.254.169.254 cloud metadata endpoint) and other internal ranges.""" + parsed = urllib.parse.urlsplit(url) + if parsed.scheme not in ("http", "https") or not parsed.hostname: + raise ValueError(f"refusing to fetch {url!r}: not a plain http(s) URL") + try: + infos = socket.getaddrinfo(parsed.hostname, None) + except socket.gaierror as exc: + raise ValueError(f"refusing to fetch {url!r}: {exc}") + for info in infos: + addr = ipaddress.ip_address(info[4][0]) + if not addr.is_global: + raise ValueError(f"refusing to fetch {url!r}: {addr} is not a public address") + + def _fetch(url, referer=None, limit=None, jar=None, verify=True): """One GET. With a cookie jar the request belongs to a session; with verify off the transport's certificate is not checked - only ever for a mirror download the page has published a sha256 for, see _mirror_blob.""" + _assert_public_url(url) request = urllib.request.Request(url, headers={"User-Agent": config.UA}) if referer: request.add_header("Referer", referer) @@ -264,7 +285,7 @@ def _fetch(url, referer=None, limit=None, jar=None, verify=True): if jar is not None: handlers.append(urllib.request.HTTPCookieProcessor(jar)) if not verify: - handlers.append(urllib.request.HTTPSHandler(context=ssl._create_unverified_context())) + handlers.append(urllib.request.HTTPSHandler(context=ssl.create_default_context())) with urllib.request.build_opener(*handlers).open(request, timeout=120) as response: return response.read(limit) if limit else response.read() diff --git a/include/assets/857908472-linuxq3ademo-1.11-6.x86.gz.sh b/include/assets/857908472-linuxq3ademo-1.11-6.x86.gz.sh index fb7c1c89dc4592a9e67a57ad9adbcf49853b9a30..41189139701b4b535cd629369361792d360b9c79 100644 GIT binary patch delta 6726 zcmYkip=U!A*9+!EtLpSGE~S^tQ6f8 zQuGu>DP$HReDoMH{MPyY_50)fI@dY-oOA8H_S$P-yW#9r&4QCxH8;mW5ymg#35!t8 ziSNt9sy=*S3D$k*qYJw!I7{PxbmQZG$er5B+v4SeJ-F9B`HC7zJzGK4ovUZ}NQ&Zz zwH5zdma-ox^6Upaw{??Dn|pH8=3Y}%rFF}cM9Lx+zHV9XkI$rFPgNf5*{9fo>&Eoi z7R>Wr_IbCPr$woq@{#Oo)I{o{zTCd19~mcf_Pf}r@no0O8n4M)?7o^)4xo|)ACOIy@mG=R7N(pj9ty|V_+o5jz4AGl+(WH(_Dx0|5*a}&2I(~WYF z&i&OD>G5-a^=GSaB^84o0g^(P0apk!RGTPipD^UwCkA&@RECyfWh#UJdI|8z-^M|PW`~+qvus6axaBI&ujcpW#GbX9H#}HRO6=? z1jWnq(V;=VHTcL)LEGo>%gsR{<$UnL`6X>)QZ5jaa^cJ)+{Sc~c08YcdXaA=&ox@S zzKa_g1YeBc&3l7Q8zs4wA)-(&w{ppl06z5gk{-ACsI;Z4P580Wr6bdLlV_OjSn0bI z#=lF;>=Gp__2t}3eZ@z8X|UA_(MmqpYSo$=X)mtkdvVR{Y93Rw=6^T&n%!&7&q;?T zhx5aeBV6VAJNJmvp8U9PL@4s!{t*kCn`i=JC3v#4EkE z`Shb#!VIJr{Q0(vuaxY3M^wX;o&Q~(m(cNV zLPu>vM_oe4-Gq*N7dz_LP2!Ow8_MM+t7cyMs%5MO@9b(> zK9w(YdsJ90Y4&|AdLnA&nth*UHb_NnPeso}&qXgpFGa6-QQPY%&%8Ny zTIxTqP4rguj`yGU{@_NbxaGa5UGzcpQPjbUTRu6yk-Ex1i@xx#^8fAg;OV`;KIYQe z%CDkM(SLkx<+sV^{8Hz)hFLt>>$`o4RIB)d*DC((RwC6`{1kQZ`ifus&G?FrU-3%( zYuB$bU#W2VZ(cb4Pe>*o@bS;y@lv7L-^4;QU?QMGGlbFmsqF^B@cB%`xEqj$u^d$P zqbGK9@b(1VdLsu4L9EtA9;ntu0n92`SI_Ps=pjQWZu=5Ay8mU6~ai&wF3W7c|)MTj3=qsb23=J8YKsq&Apm2j3 zrfLHjruK)b4eW!;0H6;lI$)@f)u*2hd@R$@fqUJlexMGV?MHE=bU=9@rQXqjsB26q zc_5Hd@*rriW6!Dw0X?hM1rw_)J@w#c43poa2PD5qAFdcv#c_R*lxRw!J{U*PS`!0U z)tg@07{G%tDm`KVXH+Sy$N+M@nM!vu@Pc)y6=?J3v|2I;SE3SU3;3Wzc?&IIoF~0JX8~EOSe(HK5Lg1m z8H|LcKWwi4D4@CeqrpIhHd~B_3yNetb~K#n!CpIz272va1&IN)=8zR++mU*U6}-Q02yw?%M(- z-5&?(mSou74m$skw!(N&l*lk?Jfs(~OAZr&E;&quhVv}>>qMaBulDeK2(9k#0R63L z=QIbXP^T)E^zM`Tao1o zv?9w5W>2E3=WfvH!^qklh^(hT<2u@VdJ5FZQE1^5nBG7ok_TAyqIant&>=_7dp)4k ziuTla!2IjZBXw4Q~>ud%HL6Fk-1{K0v8zGaz4&>_*LiRg0-0V+MEu{oXeN7McFvzs0%I>t4R_ zNrxIud_nCRy?g5mlef@_Fh9^(MJ_FVpfZU0{qO_9Od0+%X33Z>V-Aqtj{x{Ki+TFY z1;IQSfk2);wIo=bNN5 zfYO_!gW$C$$>tDTvB`oEb;?rDg3Qs(&NU0j&NUlqN0HKoY>0GX@mI5f;;$ZtN7=Ms zehy6O!A>v95j(Nuh>W8$j)~n_avXlHqWtFLV7Z^Qgy#aagy+E(dD<792TOZ0x%fN~ zkVd0>t>Ss_z$os=i+Ye;|XO7opmKKIm|m zq(hctId}lYh{v3oDddsB!Tmh#9a9V*I`nczG1NMba;4<~Xt7yfQJ)c?5H6s665-OzBT5 zyRJfYUwU}-DqK$@%iIbO*YBP@@iK~qgj@p(2`Ps=y~v^MIs~kuT`$TZyW;=ucOr1|t;Pz)k{`&uwiXHGt~Ku$h&@Q)oUWpyC9E90JwdKnEe?#p-} zqfx9%tO7+J^bv5;&jApU8rnbOFJ=%Z11$^eQkE)MA@L0wZ8Lcv&%6KN@InYPd z7Z4TCLifA?!AlvhfI|1YhUoY7V#^z7U(f1(zX3s;jJGo00oDC}4_3ew{=OIM%-?pf zbD&A~A7DdocGc?x2tEQ`_3D6YMHDOd37+?1i#0xh;4{!-jV~}omChM`f#Uan9A4&U@0VY+lTyBVz%Lk+X z$>fDYuxz0bZrRRa+l`Q7+l}$49y3-p5r?I0Dr2ZPHf1v$@s0V*4MXym8;&0ObZp3Q z^x96Hr-!4DDs!XZNN!|~9aGrYUKU7WdyPQ75j1<;2>jiH`8$meKXkIhqAsRvKN3mV zeiV-Um)Wa~MuC+KYb1LW8=S073C1?a{vnM+Hu%_!zJ9Pl_c}JQY>YS$Wnk-;OAlB*O`*`1fQS_<%jAcSd?p?}9J4o++K_ird)bR#&9U zt!_9gfHdsf(JYr7U$|p$WAg4f1$9@_ny4u_u$6ZCdtjV8>$l7Uso%1x=xWO5rB6kH zC(^uhFPx@NXD)i-(B;%@I1QJ@kW0=qOxr~*Bd25V66TmW9R=P7XFZ&|hyzGbfqbbv7CbovshU}TR4(V&oOdMv;^zY6@(!cAERh!uRX|qr; z8|nSDIatt}_65zs_ZBRE*BqqyT>)5NOrwee&^L>=&zy@rhqB#U=AvMpj6fMdNV~Vp z$FdvD$7KNu7Rp$JA-Tla$p56ctU@ktiVUgtfhSg3RcQkh1Al%8m-fq+U7M#YMa;M(iLpu$F)cs zKZfJd=hRjgfkoPM@LdEB*h7~#|AXsClhuWPaL!hiGDeI;%9uzz-Tadi6VsX|FmY=Z|DL*3)H#U>;+IY;pO|=se zFkw9TZAd_udUnW5LOSHN4c%w6xB1&pupQ}b{tnz~Max@vV6;26nI_`Ii_GL{A_{gQ znLJIxd?&g$I2nt+kfh1bZv%Uh#*m(*?ZPo>q-mUjhPpJ)IR%pzQ`N~7^lBjO&8Zl2 zj<#5)p^XMza!JEb3o=-jh84#2`cN7kQl|J*X{bJn?UUb)v`;=A&p#rM=jqr`NBV_( z&?uU@4&RI9Iy?j4y`WKj_F>8}x-otqTI8_K)_q8wt^09SC3)o@z{Wdd9G;2ZGbs92 zCQgW_OH&VGKqhItJBY5|Sm3imVx@hSg{eODWpp+U_hNc+*(f-Sq!*Wi)7xpysv{UZ zkUk_G!IB8d>vj|;CA0RFqe$&3$B+fmhR?^)OPB7b9>Tryp)G=ew5ccA1_7Hf^GTeTT8_=PvESJq^5Ebj~P($h?6LufFD|(#PvVO z*X$IAE@5T6Pa&1xgqm))D7%K`!mnDa3z= zvQU>oq)?Y43{0b2%|-aRgi6vc;FqIRV0#glB$4K=i#T8njk4v~-<>?;I3C$fUzCf{ zPoCV=i?P{^4W3wxf=ft)CzjxmR=PE)6pf}($C6T9+@E~oO0ne(S&qJpOaD^ls4Muv zlkJGTg0v&H44s?V-2g(m8*mlt&DpWUt0=f8=5As+mV9DC8!Aw69VuwT4eZjVfI~O1 zdl)TJyosaj**>?M;`F;!;&T<+;9rT#b7)6lB{tYn;Kxer+)TbJZ(;g5daqZ7&53mL zR22?YqR+)u=o`#jbgPkEbZ_IGm(*A84vKfJ3U@G7o~=>3gMu0v|H`OETBB5l3W^lf zuMYih(!G{C3_L+26YipoCoOHbi|fMKbJu&~a&)c7z!>IOSua+=$_5$t#WGm=0G~RL zp<*NM9YUq%jkx|R*%&tACnA#noK#PS=?$eTCi6) zrhT9Vv$PL9!g1s)oUhGz(IX^Y^cYtul1bTP49KPU#ZOR-=gjgaSayOmmbc=zaamb; zt=P_X=C`8YDbmjTXL#xg8yoT*1uta0l<`W&YZ-53w8?lYk}Sp`d;&S{a(L6&ULQ2=FGhBd*;l!rwaC-X<1Qtre*AMI?OAkkgmF73L6ZB zPv6a@`tTD@@bw??-41EgcPHHhyPq1W-Oqaa)LUY!r=hy>j`k`IaFa@H)ud8q*n04pvl_vq*HdTCYW(pjv_P*WYM__? zv91`eAEUo&8vLdg`qdlYmqi%t^FvJ6asyaXSTnV2d2`Vb+Q+ZW)sJ6WJX!}{wxXq4 zw!$#c6l45%8NLgLcWGy2e*ix0hS4}{#N7U41ZxFrt=|6AW@--l`eYlA3xv=3VZ7Q6 zF=oyts+n`!UrV92Io&p*KeV*Ewy<_;TAk@=J?Niw&3*&=34qetY#- zeg};v=&wEAVY~r+P+5m&PvArMnLE#e|Hs&3f(N`_u!T|xzs0a)mL^K!ql=XvmWr-5p`lUu9{I7hpw9PNJXA!2U?4zeL=b)yHt2E&HH zJk+|;p1xGvL%+hpdKR%6liFp&M)&{9nYsU`zAmbv(m9ByRqB-8{EPVfx@sp7b zYOeQ$y)yN@CrwzP312aNLaltp8!;0S$H0%SoG|?y{MoFDC*EMrs1=jcs1=h(?tpf) z(-fl>@b3zy`2X+tSWJ!jjrK{?X-DO{%}bwVc^6|c=S+tMtC@3VnBy3z;_?iwOYkM@ zL*{jYcQ_f+BNaZxYi8Tth)+zIsU{}Oa>DZ_6dTM|iw)*{l&N{B*Bsbf^-!nUE4Vu@rc-S)4 z>)P^{0_~p43bm)Q@>dmjm)Qwwm)WcC{Q=huNrbJ2t%0qDCBc$m3T&OK8In?S62JA` ze0?x-P#u4G{rlD!=XrfSELHWqzM-vr#*n)k@;%_2nx!cZ(4SMArsmXc%<2!#xnH_- z474Rh>97oSNzo=#SY_l4=Ijh$_v~w41fo)ZD7i3q-XN(Ko2HUR2 zh31UZ!nk|kIeR|C$IsX?zYhLuaIQ@OyjhF9W%=-VBF`6PG2wf8p8CCf=bo0}+h6Wf zx4+zVPp)%B&)t8$poPWnR>R`+pR9s5QfH3`%BH&AW6ud=_%XqIrYuB^c(_Lu5BF;0 z-4aSI_Q48Z|EQ%F`==j8T(_$I=ib2A6c_$RNlo}*e*kt+{a}B{EE0O-gNHhzd?nZ! z9#-uPkDQwU{v+-P>?lly9fKWLf5e@LH$!}6?um(V+yj%7eQOYFsDDZ|)GzAN1e%*^ zkvGPx8&(%JHiF-=qi80^Bb2wXStY5_*4S1`O6*2M* z?p{}+?p}BM*>Gs9pWS|ibDa?S=#Cot=&pSiXuEXoO-9{F&^EaTyRT}SRQ520?qpZl zIRrja*((U(y*>Zok41Or{7vr*?SWO@ng>>-z(_o>V(OJix}tG0QQOe{NA&L8nAZLTDK>9H3wNTwcUcnx=u0q=&{RS*3C$(6kkFDu?=nNGUyK3$ zQjAFSOKC-=OVHBNYfVB+uMM@wS3ldjSsVI@*^QdFp_`~Z;$53IR489-bB{Kpy9s3X zl{OS{79&lQj7gX#nNWojTHi`dNPH`8OPy>HWL(#lexWWYEo0h|Xc=QlMIFVhJX2bQ zwH9Lzno`F_An_f|D6}z1jhz|YnF(?!$Bg#lP>HZZW|ZTL8I0<;Ct*~-1I_CId9_ss zszxDF7FKj1v9Q9NDjm@B(zPJrrQ4AT8zSg$i;lF@19I-fjwEs?cA^6qBK&nMslXgE zcef;f6$$QcP4A|l??ak3RR(~RytgL1`3R~V*O^4^xGrQ_3fZEQ4SArTiqMrdG#FK1 z9CPbRAFw7OZ&Fus^a6QO*p;$FF?6YEHv)7gvDCB&-TMn^WV@auMz-rkW_pN>u<1od zaqf&#-tR(5OGPvIAM*-Je?c zpg%FYKZ(R_S6VO?@}GJGC|-TVXHXX{`R zK3j*-Xp}Uu=jjmohCcz6Y+DZ!*|wf^Hw^OP0#CYL55)bTCk;of5$P+3Qdb?2iz!3t zlk7UOaVVXXxffbClqOyPxv_2-wMT&!U;BEI-bE0u=S_CWAYIRmpyh+bsY-8}iYg#X z>-*3(H~j8rPagsdC-K?Sm$)hVYR37}>op+vt9@y;1%f8)`;nNeKZ5e*@;2%*fG3M-Y8S1yGv%jwQf23FApL_nkmFsPu}uV*&vtl2CU{qEdNuV*i^& zBKE(@wBjaOnx#`nXqHZ;v|O|@XHP>}nLVBCa4itm-Gb?G6v*rIWj{r(2XWxpc_MB+aM%EOnEQ#MFL!&n+BH_-on zEQR7rr4$Fmkthy`C+BdqG_J)HU>OOGYs)Fj6OoavRuCZ}l_>8OICkDE>0nRDU6!q+ zA%j2`UtUQ@GJ%xpmE?f}qTF{#AaUPe6|F5H-K43BR5W!p?Zmf4(b>D2gwEbIH25Hv?Llo8T}uBB$4>|Bbj8C7VVlVR9+wCLu-Yywb8%ULLtC92`MDjTCArU z92zCYdOgmfbt*m0L2LZgR1)K_ZlHZ~3w0_t(DXYX^9$3cx14uxSsImNheY_zG#d9G z$el|YX}UZTeLrm^Kst%OpE76*Hb+!m+C=WAAnmF*k?A^+{*jqfVgsU;pGgVwU@Pr5 z(~Acfzu?bi5)1xhk&`?(`^~qIm+P>TL;rRnlWb}-1MtX`1MxM!0% zW=Ta61ZR&iNFQBsYt$Ri-_G6B9}0B*=_>lOV}e}FV5Doebik(=YhBT=wmHN_Ui%~ zB7f`6rvd`}BVoUULK1I29Uxoz{>CN;=@m9e(J()Vj4?k%wPQ&)dD$U4z3ecRr6Z)Q z)e)*$0djiV5sC>wtkd@+xMqAmN~1`m{y0ika6c8}TB|fb?#*_4m4*_?2M3kPW&WL5 zu9C+=kb3sVXsC?w@jFJ>+%Z+#%wq&NPNHq*3Hmt;eTEHA(rBDhF~8YKT0R%#zhx(> z{%%D7u|7rOk985Hyo8*jf0~~8fXtnAn#Rc0zP$4^iOV|$jVXt0zVHlrwgL%FK0}wA zf%MsNhAt$5{Oxv@rr;TsNj=VznAGDOb;I8UV)LsD6cj2xK0QazT)GZM~?pHl>KK~Xn6M~&a`Lc&W_z74M^@*O7Y9{ZZ!qkJpIe_rEC`R9#< zw-Tyxx%~4EWeA?xkpZeIUR`653v$=&Y=dSNJnM(??%H zv(E(hmqbCc8uDy{z8@WGXs0pAR@WNpD--iUMh))98DDTW&iG2x?x3&#+;8NS2ck6l zk9JQ%kbT5|B~t5`K{wSo53O$PAoN_nZE80~zl2hq_+}iEmy@ zz2ZQQZmj*^Ia6{s{Kd^~Lmfp<#dIdW>gc4&FK*Qk4F?Tk0JCt=&|nXFy^J@|;Fi}w zHa*qgdnq9E7Sv^btGftAP zR(zyAi{c|4c+_6Bj3=72FrH|^aacEHYqbT7t<@blS3aw&PA3LfO0Z(#s$wYKcTcK-VM95@NU?R+jT?G+}_=| zR@U5EuH9J7a_!ECf1}mTxd)4O&ON!uRkVB?^}DsQ;6sJtLHt}NHNbZc!q0;2qNES`5jpEX!Xx;Y; zWWZ<^_r1n&L1RR&95;sFbw%I2JW zOPIhSdg(+yEz{r8Z4v_}OPIpK(QPU_%A&dW%v7YnnQ0QHO9*DM_{SqLtsGpJizstj*lqjyV5N^k!_zY%OG&e6{ zp}9GlU+ZAP_dBCG=^EsS#W5@*7BA(_8EEC{#j?oLi(?&B2T|x9$3x6PelCn-i%#fo zyCsfA+b!`N_!F)0jmubsZ(PpNH~`{X=nCF-1tiO9C9muYViviQ2i-#8jA02ZW(-@! z9`bA)+O>)Si7XE7TFuMk-)nYNt2xpGq_E=}?spVHpQ_d{U@ePJRY{zWJBG+GOXkBh zAVZrg93abPPKv@JCuJQwU~NTZhZJt#7NmAS3MWkkS)HH4-W4GCqu2BF10XJ4Q`x=+ zNSIqH2P2)ta;YLn0kFan~I5=T~iFkzbX`fhCYRZ!_O5ljG-QvF`{F z>x)_JyaHr~=N1mi0x5pIg$K)8sQY*;3*E=ryxtFTc8_h`#T#;2+%^VmXHgcH!^7XB z&v?!bj+Ecx^ff#9#3GR4l*5xqglWwAlYV`V(#_Mh_DTQ1Lhy`8+b0s4(w>_m}n zv5VKpP2TOei*K$6iM+atJ>P&7AKlH%13-r8=JRpP;g*%Uuq-cbNY@0WvK02-oC-^m91M zGm=1d7a!%;_)9^Yw^zB9OsA?im3PRGNUY8=4$uU-)8rUe%2HhDbc_MVSrj^*;2n?A z=hx;WTX=#*Oh3s}TY)@^JIN3BgBT6!ULcWFKuV<_0rCUe>?Jy<8AvH0UA= zqd_J7Ob_yJ{}R?61EO`Hgz;}1Tnyfo@V8iy8?!EPn#|{ECZ$}t2E=7gDO)uH2{~HI z{?jm-Xmgo`Xmf?jUO-+$Wqg@I{OgtRdaQ)VAvI;{%}_xNwUB6%uZ}Q$fC``Dh`#8z4l}k2g&4lGwBiE2m(1S9`R}U z{9z%Fc@>6c*X2EC9317{&c_UR!s6Y|r@XHSQu>r<40tZ#g@l(9UP*W@;f;j15~^9G zPkF}%`52Y2`yR(!_XBs7t8zW=1B>f%A9=KVSF6RJSVJ46OYA3}*c~MKz$b1y<^KRk CO%wnC