mirror of
https://github.com/User0332/rewards-farmer.git
synced 2026-09-16 01:31:36 +00:00
reject profile names that resolve outside data-dir
The character check allowed "." and "..", which are made entirely of allowed characters and still walk out of the directory, so the traversal guard only stopped the cases containing a separator. Reject both by name and check the resolved path against the profile root as well, since the character set constrains the characters rather than where they point. Also drop the MouseUtils and KeyboardUtils built in run_account and never used, RewardsTaskUtils builds its own, along with the two imports that leaves unused, and say "lowercased" in the no-source warning, which is what the code returns.
This commit is contained in:
@@ -5,8 +5,6 @@ import sys
|
||||
import log_utils
|
||||
import accounts
|
||||
import rewards_tasks
|
||||
import mouse_trajectory
|
||||
import mimic_typing
|
||||
from selenium import webdriver
|
||||
from selenium.common.exceptions import SessionNotCreatedException
|
||||
|
||||
@@ -54,9 +52,6 @@ def run_account(account: accounts.Account) -> bool:
|
||||
return False
|
||||
|
||||
try:
|
||||
mouse = mouse_trajectory.MouseUtils(driver)
|
||||
keyboard = mimic_typing.KeyboardUtils(driver)
|
||||
|
||||
rewards = rewards_tasks.RewardsTaskUtils(driver)
|
||||
rewards.complete_all_tasks()
|
||||
finally:
|
||||
|
||||
Reference in New Issue
Block a user