[projects/pld-builder.new] request: reject spec names with shell/glob metacharacters

[arekm]

commit 52e400c7819211f77560367988b998814ac5ce09
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Aug 26 17:14:12 2026 +0200

    request: reject spec names with shell/glob metacharacters

 PLD_Builder/request.py | 2 ++
 1 file changed, 2 insertions(+)
---
diff --git a/PLD_Builder/request.py b/PLD_Builder/request.py
index 0475a66..b6c723d 100644
--- a/PLD_Builder/request.py
+++ b/PLD_Builder/request.py
@@ -222,6 +222,8 @@ class Batch:
                 # normalize specname, specname is used as buildlog and we don't
                 # want to be exposed to directory traversal attacks
                 self.spec = text(c).split('/')[-1]
+                if not re.match(r"^[a-zA-Z0-9_+][a-zA-Z0-9._+-]*\.spec$", self.spec):
+                    log.panic("xml: evil spec name (%s)" % self.spec)
             elif c.nodeName == "command":
                 self.spec = "COMMAND"
                 self.command = text(c).strip()
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/projects/pld-builder.new.git/commitdiff/52e400c7819211f77560367988b998814ac5ce09