length filter for add to old shopping list

2022-02-03 15:46:59 +01:00 · 2022-02-03 15:46:59 +01:00 · d01cb26c4a
commit d01cb26c4a
parent 3501bcadb1
1 changed files with 1 additions and 1 deletions
--- a/cookbook/views/views.py
+++ b/cookbook/views/views.py
@ -260,7 +260,7 @@ def shopping_list(request, pk=None):  # TODO deprecate
    recipes = []
    for r in html_list:
        r = r.replace('[', '').replace(']', '')
-        if re.match(r'^([0-9])+,([0-9])+[.]*([0-9])*$', r):  # vulnerable to DoS
+        if len(r) < 10000 and re.match(r'^([0-9])+,([0-9])+[.]*([0-9])*$', r):
            rid, multiplier = r.split(',')
            if recipe := Recipe.objects.filter(pk=int(rid), space=request.space).first():
                recipes.append({'recipe': recipe.id, 'multiplier': multiplier})