From c5c36ac4645c4c593c0530c45c9026b339833982 Mon Sep 17 00:00:00 2001 From: Leander Furumo Date: Thu, 17 Sep 2026 20:16:00 +0200 Subject: [PATCH] verify payload data sent over db listener --- bot/src/cogs/galtinn.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/bot/src/cogs/galtinn.py b/bot/src/cogs/galtinn.py index d3255bc..cd35611 100644 --- a/bot/src/cogs/galtinn.py +++ b/bot/src/cogs/galtinn.py @@ -66,13 +66,18 @@ class Galtinn(commands.Cog): self.bot.logger.info("Received galtinn_auth_complete event from database") - # Surely, no one would ever send a bad payload, right? RIGHT??? - discord_user_id, galtinn_user_id = payload.split(" ") + try: + discord_user_id, galtinn_user_id = payload.split(" ", 1) + discord_user_id = int(discord_user_id) + galtinn_user_id = int(galtinn_user_id) + except (TypeError, ValueError): + self.bot.logger.error(f"Invalid galtinn_auth_complete payload: {payload!r}") + return # Fetch Galtinn user if not ( galtinn_users := await self.fetch_galtinn_users( - galtinn_user_id=int(galtinn_user_id), discord_id=int(discord_user_id) + galtinn_user_id=galtinn_user_id, discord_id=discord_user_id ) ): self.bot.logger.error(f"Failed to fetch user with ID {discord_user_id}. Not found")