Reject AS path regex containing ; and ".

An AS path regex will be considered as invalid if any of the ; and "
characters are used. These characters could be used to inject arbitrary
command due to the router command line interpretation.

This is a temporary fix for issue #13 while waiting for something better.

1 files changed, 12 insertions, 0 deletions

diff --git a/includes/utils.php b/includes/utils.php
index 96982ea..4dfe132 100644
--- a/includes/utils.php
+++ b/includes/utils.php
@@ -209,10 +209,22 @@ function match_as($as) {
 }
 
 function match_aspath_regex($aspath_regex) {
+  // Empty AS path regex
   if (empty($aspath_regex)) {
     return false;
   }
 
+  // AS path containing a ; (not a valid character)
+  if (strpos($aspath_regex, ';') !== false) {
+    return false;
+  }
+
+  // AS path containing a " (not a valid character, the string is automatically
+  // quoted if needed)
+  if (strpos($aspath_regex, '"') !== false) {
+    return false;
+  }
+
   // TODO: validate a regex with a regex?
   return true;
 }