rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-10-13 10:36:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): check endpoint control characters without a control-character regex

Browse Source 
Codacy (ESLint no-control-regex, Biome noControlCharactersInRegex) flags
the \x00-\x1f range in checkEndpoint's regex. Test the char codes
instead; the endpoints refused are unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Chuck
2026-09-17 12:56:31 -04:00
co-authored by Claude Opus 5
parent ff7ff17f46
commit 8cd08ccbc4
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web_interface/static/v3/js/plugins/api_client.js
+2 -1
View File
@@ -135,7 +135,8 @@ const PluginAPI = {
checkEndpoint(endpoint) { checkEndpoint(endpoint) {
const path = typeof endpoint === 'string' ? endpoint.split(/[?#]/)[0] : ''; const path = typeof endpoint === 'string' ? endpoint.split(/[?#]/)[0] : '';
if (!path.startsWith('/') || path.startsWith('//') || if (!path.startsWith('/') || path.startsWith('//') ||
/[\\\s\x00-\x1f\x7f]/.test(endpoint) || /[\\\s]/.test(endpoint) ||
Array.from(endpoint).some(ch => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f) ||
path.split('/').some(segment => segment === '..' || segment === '.')) { path.split('/').some(segment => segment === '..' || segment === '.')) {
throw { throw {
error_code: 'INVALID_ENDPOINT', error_code: 'INVALID_ENDPOINT',