Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
Sharkey
Manage
Activity
Members
Labels
Plan
Issues
342
Issue boards
Milestones
Iterations
Wiki
Requirements
Code
Merge requests
28
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package Registry
Container Registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
TransFem.org
Sharkey
Commits
2a8e93e4
Commit
2a8e93e4
authored
1 year ago
by
KevinWh0
Browse files
Options
Downloads
Patches
Plain Diff
Fixed code injection from twitter import
parent
2811f4cc
No related branches found
Branches containing commit
No related tags found
Tags containing commit
3 merge requests
!449
release 2024.3.1
,
!448
Release 2023.3.1 - Codename #NotDeadYet
,
!390
CVE: Fixed code injection from twitter import
Pipeline
#54
passed with stage
Stage: test
in 1 minute and 50 seconds
Changes
1
Pipelines
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
packages/backend/src/queue/processors/ImportNotesProcessorService.ts
+25
-17
25 additions, 17 deletions
...ckend/src/queue/processors/ImportNotesProcessorService.ts
with
25 additions
and
17 deletions
packages/backend/src/queue/processors/ImportNotesProcessorService.ts
+
25
−
17
View file @
2a8e93e4
...
...
@@ -130,6 +130,17 @@ export class ImportNotesProcessorService {
return
typeof
obj
[
Symbol
.
iterator
]
===
'
function
'
;
}
private
parseTwitterFile
(
str
:
string
)
:
null
|
[{
tweet
:
any
}]
{
const
removed
=
str
.
replace
(
new
RegExp
(
'
window
\\
.YTD
\\
.tweets
\\
.part0 =
'
,
'
g
'
),
''
);
try
{
return
JSON
.
parse
(
removed
);
}
catch
(
error
)
{
//The format is not what we expected. Either this file was tampered with or twitters exports changed
return
null
;
}
}
@
bindThis
public
async
process
(
job
:
Bull
.
Job
<
DbNoteImportJobData
>
):
Promise
<
void
>
{
this
.
logger
.
info
(
`Starting note import of
${
job
.
data
.
user
.
id
}
...`
);
...
...
@@ -175,23 +186,20 @@ export class ImportNotesProcessorService {
try
{
this
.
logger
.
succ
(
`Unzipping to
${
outputPath
}
`
);
ZipReader
.
withDestinationPath
(
outputPath
).
viaBuffer
(
await
fs
.
promises
.
readFile
(
destPath
));
const
fakeWindow
:
any
=
{
window
:
{
YTD
:
{
tweets
:
{
part0
:
{},
},
},
},
};
const
script
=
new
vm
.
Script
(
fs
.
readFileSync
(
outputPath
+
'
/data/tweets.js
'
,
'
utf-8
'
));
const
context
=
vm
.
createContext
(
fakeWindow
);
script
.
runInContext
(
context
);
const
tweets
=
Object
.
keys
(
fakeWindow
.
window
.
YTD
.
tweets
.
part0
).
reduce
((
m
,
key
,
i
,
obj
)
=>
{
return
m
.
concat
(
fakeWindow
.
window
.
YTD
.
tweets
.
part0
[
key
].
tweet
);
},
[]);
const
processedTweets
=
await
this
.
recreateChain
([
'
id_str
'
],
[
'
in_reply_to_status_id_str
'
],
tweets
,
false
);
this
.
queueService
.
createImportTweetsToDbJob
(
job
.
data
.
user
,
processedTweets
,
null
);
const
unprocessedTweetJson
=
this
.
parseTwitterFile
(
fs
.
readFileSync
(
outputPath
+
'
/data/tweets.js
'
,
'
utf-8
'
));
//Make sure that it isnt null (because if something went wrong in parseTwitterFile it returns null)
if
(
unprocessedTweetJson
)
{
const
tweets
=
Object
.
keys
(
unprocessedTweetJson
).
reduce
((
m
,
key
,
i
,
obj
)
=>
{
return
m
.
concat
(
unprocessedTweetJson
[
i
].
tweet
);
},
[]);
const
processedTweets
=
await
this
.
recreateChain
([
'
id_str
'
],
[
'
in_reply_to_status_id_str
'
],
tweets
,
false
);
this
.
queueService
.
createImportTweetsToDbJob
(
job
.
data
.
user
,
processedTweets
,
null
);
}
else
{
this
.
logger
.
warn
(
'
Failed to import twitter notes due to malformed file
'
);
}
}
finally
{
cleanup
();
}
...
...
This diff is collapsed.
Click to expand it.
Ghost User
@ghost
mentioned in commit
a6e257f5
·
1 year ago
mentioned in commit
a6e257f5
mentioned in commit a6e257f502296495cf2c1bdc7565e9ce34848506
Toggle commit list
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment