fix: some security advisories

l3s-learnweb · Jul 19, 2024 · bc95dcb · bc95dcb
1 parent 25f468b
commit bc95dcb
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/...rs/YouTubeConnector/src/main/java/de/l3s/interweb/connector/youtube/YouTubeConnector.java b/...rs/YouTubeConnector/src/main/java/de/l3s/interweb/connector/youtube/YouTubeConnector.java
@@ -27,7 +27,7 @@
 @Dependent
 public class YouTubeConnector implements SearchConnector, DescribeConnector {
     private static final Logger log = Logger.getLogger(YouTubeConnector.class);
-    private static final Pattern pattern = Pattern.compile("(?:https?:)?//(?:[0-9A-Z-]+\\.)?(?:youtu\\.be/|(?:youtube\\.com|youtube-nocookie\\.com)\\S*[^\\w\\-\\s])([\\w\\-]{11})(?=[^\\w\\-]|$)(?![?=&+%\\w]*(?:['\"][^<>]*>|</a>))[?=&+%\\w]*", Pattern.CASE_INSENSITIVE);
+    private static final Pattern pattern = Pattern.compile("(?:https?:)?//(?:[\\w-]+\\.)?(?:youtu\\.be/|(?:youtube\\.com|youtube-nocookie\\.com)\\S*[^\\w\\-\\s])([\\w\\-]{11})(?=[^\\w\\-]|$)(?![?=&+%\\w]*(?:['\"][^<>]*>|</a>))[?=&+%\\w]*", Pattern.CASE_INSENSITIVE);
     private static final int fallbackPerPage = 50;
 
     @RestClient

diff --git a/interweb-core/src/main/java/de/l3s/interweb/core/describe/DescribeConnector.java b/interweb-core/src/main/java/de/l3s/interweb/core/describe/DescribeConnector.java
@@ -13,10 +13,14 @@ public interface DescribeConnector extends Connector {
     Pattern getLinkPattern();
 
     default String findId(String link) {
-        final Matcher vimeoMatcher = getLinkPattern().matcher(link);
-        if (vimeoMatcher.find()) {
-            for (int i = 1; i <= vimeoMatcher.groupCount(); i++) {
-                String group = vimeoMatcher.group(i);
+        if (link.length() > 1000) {
+            throw new IllegalArgumentException("Input too long");
+        }
+
+        final Matcher matcher = getLinkPattern().matcher(link);
+        if (matcher.find()) {
+            for (int i = 1; i <= matcher.groupCount(); i++) {
+                String group = matcher.group(i);
                 if (group != null) {
                     return group;
                 }