From cbc4bfdd98061107bc8baf877ce9baf2f03366fc Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 6 Aug 2026 19:26:24 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- .../root/usr/share/ssr/utils/autoban.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py b/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py index 1bbb65c9b..8a8acd867 100755 --- a/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py +++ b/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py @@ -25,9 +25,12 @@ from __future__ import absolute_import, division, print_function, \ with_statement import os +import re import sys import argparse +_VALID_IP_RE = re.compile(r'^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$') + if __name__ == '__main__': parser = argparse.ArgumentParser(description='See README') parser.add_argument('-c', '--count', default=3, type=int, @@ -45,7 +48,7 @@ if __name__ == '__main__': sys.stdout.flush() else: ips[ip] += 1 - if ip not in banned and ips[ip] >= config.count: + if ip not in banned and ips[ip] >= config.count and _VALID_IP_RE.match(ip): banned.add(ip) cmd = 'iptables -A INPUT -s %s -j DROP' % ip print(cmd, file=sys.stderr)