Add some safety checks.HEADmaster

1 files changed, 35 insertions, 1 deletions

diff --git a/dns.php b/dns.php
index 2f93759..4012f1f 100644
--- a/dns.php
+++ b/dns.php
@@ -93,6 +93,7 @@ function writezone($domain, $zonetext, $password = null) {
   }
 
   // Escape characters that will break the echo later on
+  $zonetext = str_replace('\\', '', $zonetext);
   $zonetext = str_replace('$', '\$', $zonetext);
   $zonetext = str_replace('"', '\"', $zonetext);
 
@@ -139,6 +140,39 @@ function writezone($domain, $zonetext, $password = null) {
 
 // Main entry point
 
+// Ensure zone names are valid
+if (isset($_GET['zone'])) {
+  if (strlen($_GET['zone']) < 3) {
+    die("error: provided zone is too short\n");
+  }
+
+  if (preg_match("/[^a-z0-9-\.]/", $_GET['zone'])) {
+    die("error: provided zone is invalid\n");
+  }
+}
+
+// Ensure hashes are valid
+if (isset($_GET['hash'])) {
+  if (strlen($_GET['hash']) != 64) {
+    die("error: provided hash doesn't appear to be hex encoded SHA256 - too short\n");
+  }
+
+  if (preg_match("/[^A-Fa-f0-9]/", $_GET['hash'])) {
+    die("error: provided hash doesn't appear to be hex encoded SHA256 - invalid characters\n");
+  }
+}
+
+// Ensure domain names are valid
+if (isset($_POST['domain'])) {
+  if (strlen($_POST['domain']) < 3) {
+    die("error: provided domain is too short\n");
+  }
+
+  if (preg_match("/[^a-z0-9-\.]/", $_POST['domain'])) {
+    die("error: provided domain is invalid\n");
+  }
+}
+
 if (isset($_GET['mode']) && isset($_GET['zone']) && isset($_GET['hash']) && strlen($_GET['hash']) > 10) {
   // Some sort of mode (at the moment only "update" is supported
   if ($_GET['mode'] == "update") {
@@ -272,7 +306,7 @@ if (isset($_GET['mode']) && isset($_GET['zone']) && isset($_GET['hash']) && strl
   }
 } else if (isset($_POST['domain']) && isset($_POST['password']) && !isset($_POST['zonetext'])) {
   if (!preg_match('/^[0-9A-Za-z\.\-]*$/', $_POST['domain'])) {
-    die("invalid domain");
+    die("invalid character in domain");
   }
 
   $password = hash("sha256", $_POST['password']);