Pi-hole: gravity.sh blocklist URL regex should allow semicolons

[pgl]

After some discussion on Reddit:

• https://www.reddit.com/r/pihole/comments/gqp30x/i_just_updated_to_50_and_im_trying_to_do_a_pihole/frv2yla/?context=3

It seems that the script doesn't consider a semicolon (;) valid in blocklist URLs. My list uses them by defaults as query string parameter delimiters, eg:

• https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts;showintro=0

Relevant line is here:

• https://github.com/pi-hole/pi-hole/blob/4d25f695267590b61a4061f9bb43448005d99b85/gravity.sh#L379

[PromoFaux]

This particular line was added in response to a vulnerability discovered (see
https://github.com/pi-hole/pi-hole/pull/3237 and blogpost)

Stack overflow seems to suggest that a ; is valid, albiet rarely used, in a domain:

https://stackoverflow.com/questions/1178024/can-a-url-contain-a-semicolon-and-still-be-valid/2622966#2622966

I think we can probably get away with including ; in the validation regex, as the vulnerability was mostly caused by passing through a complete command with spaces.

I'd like to get @Frichetten's opinion, just in case...

Also @pgl Please can you base your PR on and submit it against the development branch, as per contribution guidelines? Thanks!

[pgl]

Done! Sorry for not following procedure first time round.

[Frichetten]

@PromoFaux / @pgl , I don't see any reason ';' can't be allowed. Looking through the code and some light testing of curl, it doesn't appear you can do anything with it at this point. I'd say you're pretty safe to allow the pull request to go through. :)

[PromoFaux]

Thanks!

[pralor-bot]

This issue has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/pi-hole-5-1-released/35577/1