SAB hardening (TRaSH blocklist) + provider prompt input validation - #118
Merged
Conversation
Field feedback, round two: (1) typing a provider NAME that isn't a preset silently became a bogus 'hostname' and SAB registered a server that can never connect — the flag path has rejected that since the audit, but the interactive prompt never got the guard. The prompt now says what it wants (preset name or server hostname, with an example) and re-asks on anything that is neither. (2) SAB ships with an empty unwanted-extensions list and action 'do nothing' — no protection against executables riding usenet downloads. New EnsureSABHardening lane applies the TRaSH blocklist verbatim (exe, js, vbs, ps1, …), fails matching jobs into History, and turns on direct + flattened unpack. An empty list is the factory state, not a choice (the never-configured-auth precedent), so it completes on adopted installs too; any existing list is the user's and is never touched. CI asserts the blocklist, action, and direct_unpack in the real sabnzbd.ini.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round-two walkthrough feedback:
Provider prompt was ambiguous and accepted garbage. It asked "Provider [newshosting]:" — a non-preset NAME (say, a provider not in the five presets) silently became a bogus custom "hostname", and SAB registered a server that can never connect. The prompt now reads "Provider — preset name or server hostname (e.g. news.newsdemon.com)" and re-asks with the preset list when the answer is neither a preset nor something with a dot in it. (The flag path has had this guard since the audit; the prompt path was the gap.)
SABnzbd had zero unwanted-extension protection. Factory SAB: empty blocklist, action "do nothing". New
EnsureSABHardeninglane applies the TRaSH SABnzbd guide verbatim:unwanted_extensions= the full TRaSH blocklist (exe, js, vbs, ps1, msi, scr, …)action_on_unwanted_extensions = 2(fail the job into History)direct_unpackandflat_unpackonAdoption policy: an empty list is the factory state, not a choice — same precedent as completing never-configured auth — so it completes on adopted installs too; any existing list is the user's and is never touched. Config key names verified against a live SAB. CI asserts blocklist + action + direct_unpack in the real sabnzbd.ini.