From 7c29cce3cb92aeadc1ec589c96b36936e38fe8c1 Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Tue, 4 Jun 2019 02:04:33 +0000 Subject: searchview: do not allow non-ASCII offsets and limits Non-ASCII digits would be interpreted as zero when used as integers. --- lib/PublicInbox/SearchView.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/PublicInbox/SearchView.pm b/lib/PublicInbox/SearchView.pm index 6592b3b2..b089de9c 100644 --- a/lib/PublicInbox/SearchView.pm +++ b/lib/PublicInbox/SearchView.pm @@ -308,12 +308,12 @@ sub new { my ($class, $qp) = @_; my $r = $qp->{r}; - my ($l) = (($qp->{l} || '') =~ /(\d+)/); + my ($l) = (($qp->{l} || '') =~ /([0-9]+)/); $l = $LIM if !$l || $l > $LIM; bless { q => $qp->{'q'}, x => $qp->{x} || '', - o => (($qp->{o} || '0') =~ /(\d+)/), + o => (($qp->{o} || '0') =~ /([0-9]+)/), l => $l, r => (defined $r && $r ne '0'), }, $class; -- cgit v1.2.3-24-ge0c7