Skip to content

[Security] (low risk) New coins: restrict charset of ticker and name #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
phm87 wants to merge 4 commits into
base: next
Choose a base branch
from
Open

[Security] (low risk) New coins: restrict charset of ticker and name #343

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
62ca5b0
Update rawcoins.php
phm87 Oct 27, 2018
f52b250
updateRawCoin : restrict charset of new coins
phm87 Oct 28, 2018
6395fe4
Update rawcoins.php
phm87 Oct 29, 2018
f73a438
Fix of condition (to test) & allow space in coin name
phm87 Feb 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions web/yaamp/core/backend/rawcoins.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,6 +455,16 @@ function updateRawCoin($marketname, $symbol, $name='unknown')
{
if($symbol == 'BTC') return;

// Restrict $symbol and $name to strict defined set of characters (to protect from rogue exchange or DNS attack on exchange)
if (preg_match('/[^A-Za-z0-9_\$]/', $symbol)) {
debuglog("weird symbol $symbol from $marketname");
return;
}
if (preg_match('/[^A-Za-z0-9_\$ ]/', $name)) {
debuglog("weird name $name for symbol $symbol from $marketname");
return;
}

$coin = getdbosql('db_coins', "symbol=:symbol", array(':symbol'=>$symbol));
if(!$coin && YAAMP_CREATE_NEW_COINS)
{
Expand Down