deblan-mirror/mautrix-go
1
0
Fork 0
mirror of https://mau.dev/mautrix/go.git synced 2026-03-14 14:25:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

federation/eventauth: disable underscore support in string power levels

Browse source
This commit is contained in:
Tulir Asokan 2026-02-16 14:29:09 +02:00
commit 53ed8526c6
2 changed files with 5 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

11
federation/eventauth/eventauth.go
View file

@ -799,7 +799,7 @@ func parsePythonInt(val gjson.Result) *int {
return ptr.Ptr(int(val.Int()))
case gjson.String:
// strconv.Atoi accepts signs as well as leading zeroes, so we just need to trim spaces beforehand
num, err := strconv.Atoi(removeUnderscores(strings.TrimSpace(val.Str)))
num, err := strconv.Atoi(strings.TrimSpace(val.Str))
if err != nil {
return nil
}
@ -810,15 +810,6 @@ func parsePythonInt(val gjson.Result) *int {
}
}
func removeUnderscores(num string) string {
numWithoutSign := strings.TrimPrefix(strings.TrimPrefix(num, "+"), "-")
if strings.HasPrefix(numWithoutSign, "_") || strings.HasSuffix(numWithoutSign, "_") {
// Leading or trailing underscores are not valid, let strconv.Atoi fail
return num
}
return strings.ReplaceAll(num, "_", "")
}
func safeParsePowerLevels(content jsontext.Value, into *event.PowerLevelsEventContent) {
*into = event.PowerLevelsEventContent{
Users: make(map[id.UserID]int),

7
federation/eventauth/eventauth_internal_test.go
View file

@ -41,13 +41,14 @@ var pythonIntTests = []pythonIntTest{
{"StringWithMinusSign", `"-123"`, -123},
{"StringWithSpaces", `" 123 "`, 123},
{"StringWithSpacesAndSign", `" -123 "`, -123},
{"StringWithUnderscores", `"123_456"`, 123456},
{"StringWithUnderscores", `"123_456"`, 123456},
//{"StringWithUnderscores", `"123_456"`, 123456},
//{"StringWithUnderscores", `"123_456"`, 123456},
{"InvalidStringWithTrailingUnderscore", `"123_456_"`, 0},
{"InvalidStringWithMultipleUnderscores", `"123__456"`, 0},
{"InvalidStringWithLeadingUnderscore", `"_123_456"`, 0},
{"InvalidStringWithUnderscoreAfterSign", `"+_123_456"`, 0},
{"InvalidStringWithUnderscoreAfterSpace", `" _123_456"`, 0},
{"StringWithUnderscoresAndSpaces", `" +1_2_3_4_5_6 "`, 123456},
//{"StringWithUnderscoresAndSpaces", `" +1_2_3_4_5_6 "`, 123456},
}
func TestParsePythonInt(t *testing.T) {