VercodeOperation: only allow simple math expresssions and %c

[fdroidserver.git] / fdroidserver / common.py

diff --git a/fdroidserver/common.py b/fdroidserver/common.py
index 93a6945f825aa16470d3860125d54bac729fdbd8..cf1d92035f9473f42b221ca6b9ad5e461c24149b 100644 (file)
--- a/fdroidserver/common.py
+++ b/fdroidserver/common.py
@@ -61,6 +61,8 @@ from .asynchronousfilereader import AsynchronousFileReader
 # has to be manually set in test_aapt_version()
 MINIMUM_AAPT_VERSION = '26.0.0'
 
+VERCODE_OPERATION_RE = re.compile(r'^([ 0-9/*+-]|%c)+$')
+
 # A signature block file with a .DSA, .RSA, or .EC extension
 CERT_PATH_REGEX = re.compile(r'^META-INF/.*\.(DSA|EC|RSA)$')
 APK_NAME_REGEX = re.compile(r'^([a-zA-Z][\w.]*)_(-?[0-9]+)_?([0-9a-f]{7})?\.apk')