|                                        |                                                                                                                        |
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `def is_invalid_get_request_uri(uri):` |                                                                                                                        |
|                                        | `if current_app.debug:`                                                                                                |
|                                        | `return False`                                                                                                         |
|                                        | `try:`                                                                                                                 |
|                                        | `ip = ipaddress.ip_address(furl(uri).host)`                                                                            |
|                                        | `except:`                                                                                                              |
|                                        | `ip = None`                                                                                                            |
|                                        | ``                                                                                                                     |
|                                        | `if ip:`                                                                                                               |
|                                        | `return ip.is_private or ip.is_link_local or ip.is_reserved or ip.is_loopback or ip.is_multicast or ip.is_unspecified` |
|                                        | `return False`                                                                                                         |
|                                        | ``                                                                                                                     |
|                                        | ``                                                                                                                     |
|                                        | `def is_invalid_post_request_uri(uri):`                                                                                |
|                                        | `return is_inv`                                                                                                        |

https://codeberg.org/rimu/pyfedi/commit/ada8e2ea35ec687000b7e7c2343288d44a219c3a

[–] mathemachristian@hexbear.net 3 points 2 hours ago

I mean they weren't given any heads up but had to instantly shut down their servers and figure out what was going on and come up with a solution on the spot. Not that I think piefed is well-made but just publicly posting critical security vulnerabilities is a dick move.

[–] MoonMelon@lemmy.ml 10 points 8 hours ago

Bare except, too. Not ideal.