Validate mirror_list.txt a bit more. 🔼

It's external input.


reported=2019-11-01 05:49:51

reporter=onefang

priority=high

category=TODO

severity=major

resolution=fixed


2019-11-15 04:05:22 onefang: Input validation - I need to remove anything that might turn into a Lua assignment (=), or a Lua function call ((){}[[]]).  Probably should remove any module loading stuff to.

Output validation - I need to remove anything that'll screw with URLs badly.

Check FDQN / first part of BaseURL before the slash.

Check bit after the BaseURL slash is only a path.

Check "Protocols" is well formed and only includes the protocols we care about.