From 8cd08ccbc45f5910aec84134d49a7c58fa4b5f2a Mon Sep 17 00:00:00 2001 From: Chuck <33324927+ChuckBuilds@users.noreply.github.com> Date: Thu, 17 Sep 2026 12:56:31 -0400 Subject: [PATCH] fix(web): check endpoint control characters without a control-character regex Codacy (ESLint no-control-regex, Biome noControlCharactersInRegex) flags the \x00-\x1f range in checkEndpoint's regex. Test the char codes instead; the endpoints refused are unchanged. Co-Authored-By: Claude Opus 5 --- web_interface/static/v3/js/plugins/api_client.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web_interface/static/v3/js/plugins/api_client.js b/web_interface/static/v3/js/plugins/api_client.js index 11908e4e..67e2b905 100644 --- a/web_interface/static/v3/js/plugins/api_client.js +++ b/web_interface/static/v3/js/plugins/api_client.js @@ -135,7 +135,8 @@ const PluginAPI = { checkEndpoint(endpoint) { const path = typeof endpoint === 'string' ? endpoint.split(/[?#]/)[0] : ''; if (!path.startsWith('/') || path.startsWith('//') || - /[\\\s\x00-\x1f\x7f]/.test(endpoint) || + /[\\\s]/.test(endpoint) || + Array.from(endpoint).some(ch => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f) || path.split('/').some(segment => segment === '..' || segment === '.')) { throw { error_code: 'INVALID_ENDPOINT',