Cutlery/calibre
1
0
Fork 0
mirror of https://github.com/kovidgoyal/calibre.git synced 2025-07-09 03:04:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

Sandboxed network requests must start with book/

Browse Source
This commit is contained in:
Kovid Goyal 2019-10-16 07:03:33 +05:30
parent a8bd8f806d
commit df2756faa3
No known key found for this signature in database
GPG Key ID: 06BC317B515ACE7C
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/calibre/gui2/viewer/web_view.py
View File

@ -40,6 +40,7 @@ try:
except ImportError: except ImportError:
import sip import sip
SANDBOX_HOST = FAKE_HOST.rpartition('.')[0] + '.sandbox'
vprefs = JSONConfig('viewer-webengine') vprefs = JSONConfig('viewer-webengine')
viewer_config_dir = os.path.join(config_dir, 'viewer') viewer_config_dir = os.path.join(config_dir, 'viewer')
vprefs.defaults['session_data'] = {} vprefs.defaults['session_data'] = {}
@ -116,17 +117,21 @@ class UrlSchemeHandler(QWebEngineUrlSchemeHandler):
QWebEngineUrlSchemeHandler.__init__(self, parent) QWebEngineUrlSchemeHandler.__init__(self, parent)
self.mathjax_dir = P('mathjax', allow_user_override=False) self.mathjax_dir = P('mathjax', allow_user_override=False)
self.mathjax_manifest = None self.mathjax_manifest = None
self.allowed_hosts = (FAKE_HOST, FAKE_HOST.rpartition('.')[0] + '.sandbox') self.allowed_hosts = (FAKE_HOST, SANDBOX_HOST)
def requestStarted(self, rq): def requestStarted(self, rq):
if bytes(rq.requestMethod()) != b'GET': if bytes(rq.requestMethod()) != b'GET':
rq.fail(rq.RequestDenied) rq.fail(rq.RequestDenied)
return return
url = rq.requestUrl() url = rq.requestUrl()
if url.host() not in self.allowed_hosts or url.scheme() != FAKE_PROTOCOL: host = url.host()
if host not in self.allowed_hosts or url.scheme() != FAKE_PROTOCOL:
rq.fail(rq.UrlNotFound) rq.fail(rq.UrlNotFound)
return return
name = url.path()[1:] name = url.path()[1:]
if host == SANDBOX_HOST and not name.startswith('book/'):
rq.fail(rq.UrlNotFound)
return
if name.startswith('book/'): if name.startswith('book/'):
name = name.partition('/')[2] name = name.partition('/')[2]
if name == '__index__': if name == '__index__':