From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 78F766DE0210 for ; Sun, 4 Feb 2018 20:20:11 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.007 X-Spam-Level: X-Spam-Status: No, score=-0.007 tagged_above=-999 required=5 tests=[AWL=-0.007] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rWqoDal2u-3A for ; Sun, 4 Feb 2018 20:20:11 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTPS id D5BE56DE010F for ; Sun, 4 Feb 2018 20:20:10 -0800 (PST) Received: from fifthhorseman.net (ool-6c3a0662.static.optonline.net [108.58.6.98]) by che.mayfirst.org (Postfix) with ESMTPSA id 137DCF99A for ; Sun, 4 Feb 2018 23:20:10 -0500 (EST) Received: by fifthhorseman.net (Postfix, from userid 1000) id C12EB21D98; Sun, 4 Feb 2018 23:20:05 -0500 (EST) From: Daniel Kahn Gillmor To: Notmuch Mail Subject: [PATCH 11/11] nmweb: handle non-numeric timestamp inputs Date: Sun, 4 Feb 2018 23:19:59 -0500 Message-Id: <20180205041959.22066-12-dkg@fifthhorseman.net> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20180205041959.22066-1-dkg@fifthhorseman.net> References: <20180205041959.22066-1-dkg@fifthhorseman.net> X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.24 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Feb 2018 04:20:11 -0000 Without this check, it's trivial to crash the nmweb daemon with a ValueError by putting a non-numeric value in befores or afters. --- contrib/notmuch-web/nmweb.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/contrib/notmuch-web/nmweb.py b/contrib/notmuch-web/nmweb.py index eaeeb507..21276b66 100755 --- a/contrib/notmuch-web/nmweb.py +++ b/contrib/notmuch-web/nmweb.py @@ -65,9 +65,12 @@ class search: befores = web.input(befores=None).befores else: befores = '4294967296' # 2^32 - if int(afters) > 0 or int(befores) < 4294967296: - redir = True - terms += ' %s..%s' % (afters, befores) + try: + if int(afters) > 0 or int(befores) < 4294967296: + redir = True + terms += ' %s..%s' % (afters, befores) + except ValueError: + pass if redir: raise web.seeother('/search/%s' % quote_plus(terms)) web.header('Content-type', 'text/html') -- 2.15.1