From b587b24c7b36b9b1d1d07be8c2c8a231a98bd452 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= Date: Sun, 21 Jun 2026 17:22:59 +0400 Subject: [PATCH] =?UTF-8?q?v1.0.92:=20=D1=88=D0=B0=D0=B31=20=E2=80=94=20SQ?= =?UTF-8?q?L-=D0=B8=D0=BD=D1=8A=D0=B5=D0=BA=D1=86=D0=B8=D1=8F,=20=D0=B2?= =?UTF-8?q?=D0=B0=D0=BB=D0=B8=D0=B4=D0=B0=D1=86=D0=B8=D1=8F=20UUID?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/convert_server.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/deploy/convert_server.py b/deploy/convert_server.py index 04fabf4..c92f552 100755 --- a/deploy/convert_server.py +++ b/deploy/convert_server.py @@ -7,7 +7,7 @@ class ThreadingHTTPServer(ThreadingMixIn, HTTPServer): """Многопоточный HTTP-сервер.""" daemon_threads = True from urllib.parse import urlparse, parse_qs -import subprocess, tempfile, os, sys, json, time +import subprocess, tempfile, os, sys, json, time, re import httpx from llm_prompt import build_prompt @@ -91,6 +91,10 @@ class Handler(BaseHTTPRequestHandler): if not cid: self.send_error(400, "contract_id required") return + # Validate UUID to prevent SQL injection + if not re.fullmatch(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', cid, re.I): + self.send_error(400, "invalid contract_id format") + return self.send_response(200) self.send_header("Content-Type", "text/event-stream; charset=utf-8")