diff options
| author | Bas Alberts <bas@anti.computer> | 2022-12-22 22:43:23 -0500 |
|---|---|---|
| committer | Bas Alberts <bas@anti.computer> | 2022-12-22 22:43:23 -0500 |
| commit | 0114d8a43161ed8bf90e988d9125af4ae6e61165 (patch) | |
| tree | d437ad09be0781f47c820bec343f6f2d2dcc526f | |
| parent | e494fb8d507311de8452db3e6f111b1e32cc3c4d (diff) | |
further harden custom emoji regex filtering
Prevent empty string shortcodes from creating dotfiles inside the
custom emoji download dir to prevent e.g. ".envrc" and other such
contextual dotfiles from being created in the legitimate download
location.
| -rw-r--r-- | lisp/mastodon-toot.el | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lisp/mastodon-toot.el b/lisp/mastodon-toot.el index 06c49a3..d1e8cbe 100644 --- a/lisp/mastodon-toot.el +++ b/lisp/mastodon-toot.el @@ -614,8 +614,8 @@ To use the downloaded emoji, run `mastodon-toot--enable-custom-emoji'." (shortcode (alist-get 'shortcode x))) ;; skip anything that contains unexpected characters (when (and url shortcode - (string-match-p "^[a-zA-Z0-9-_]*$" shortcode) - (string-match-p "^[a-zA-Z]*$" (file-name-extension url))) + (string-match-p "^[a-zA-Z0-9-_]+$" shortcode) + (string-match-p "^[a-zA-Z]+$" (file-name-extension url))) (url-copy-file url (concat mastodon-custom-emoji-dir |