Merge pull request #13650 from mtruj013/notice-id-bug

Check notice id string before calling api
canonical · Mar 6, 2024 · 5868739 · 5868739
2 parents d56101f + 422b778
commit 5868739
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/webapp/security/views.py b/webapp/security/views.py
@@ -37,7 +37,11 @@ def get_processed_details(notice):
 
 
 def notice(notice_id):
-    notice = security_api.get_notice(notice_id)
+    # Check if notice_id is a valid USN or LSN
+    if re.fullmatch(r"(USN|LSN|SSN)-\d{1,5}-\d{1,2}", notice_id):
+        notice = security_api.get_notice(notice_id)
+    else:
+        flask.abort(404)
 
     if not notice:
         flask.abort(404)