From 5f16dd3e1b8b65217f8dc19af09e15df790143dd Mon Sep 17 00:00:00 2001
From: Luke Bratch <luke@bratch.co.uk>
Date: Tue, 11 Aug 2026 21:53:12 +0100
Subject: Add some safety checks.

---
 dns.php | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/dns.php b/dns.php
index 2f93759..4012f1f 100644
--- a/dns.php
+++ b/dns.php
@@ -93,6 +93,7 @@ function writezone($domain, $zonetext, $password = null) {
   }
 
   // Escape characters that will break the echo later on
+  $zonetext = str_replace('\\', '', $zonetext);
   $zonetext = str_replace('$', '\$', $zonetext);
   $zonetext = str_replace('"', '\"', $zonetext);
 
@@ -139,6 +140,39 @@ function writezone($domain, $zonetext, $password = null) {
 
 // Main entry point
 
+// Ensure zone names are valid
+if (isset($_GET['zone'])) {
+  if (strlen($_GET['zone']) < 3) {
+    die("error: provided zone is too short\n");
+  }
+
+  if (preg_match("/[^a-z0-9-\.]/", $_GET['zone'])) {
+    die("error: provided zone is invalid\n");
+  }
+}
+
+// Ensure hashes are valid
+if (isset($_GET['hash'])) {
+  if (strlen($_GET['hash']) != 64) {
+    die("error: provided hash doesn't appear to be hex encoded SHA256 - too short\n");
+  }
+
+  if (preg_match("/[^A-Fa-f0-9]/", $_GET['hash'])) {
+    die("error: provided hash doesn't appear to be hex encoded SHA256 - invalid characters\n");
+  }
+}
+
+// Ensure domain names are valid
+if (isset($_POST['domain'])) {
+  if (strlen($_POST['domain']) < 3) {
+    die("error: provided domain is too short\n");
+  }
+
+  if (preg_match("/[^a-z0-9-\.]/", $_POST['domain'])) {
+    die("error: provided domain is invalid\n");
+  }
+}
+
 if (isset($_GET['mode']) && isset($_GET['zone']) && isset($_GET['hash']) && strlen($_GET['hash']) > 10) {
   // Some sort of mode (at the moment only "update" is supported
   if ($_GET['mode'] == "update") {
@@ -272,7 +306,7 @@ if (isset($_GET['mode']) && isset($_GET['zone']) && isset($_GET['hash']) && strl
   }
 } else if (isset($_POST['domain']) && isset($_POST['password']) && !isset($_POST['zonetext'])) {
   if (!preg_match('/^[0-9A-Za-z\.\-]*$/', $_POST['domain'])) {
-    die("invalid domain");
+    die("invalid character in domain");
   }
 
   $password = hash("sha256", $_POST['password']);
-- 
cgit v1.3