xTr1m/GameList
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape rendered suggestion content and validate URLs

Browse Source
This commit is contained in:
Frank Tovar
2026-02-05 16:51:05 +01:00
parent d88469724a
commit 1d28ea6568
4 changed files with 76 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Endpoints/EndpointHelpers.cs
View File

@@ -164,6 +164,13 @@ internal static class EndpointHelpers
return data[8..].StartsWith(brandBytes);
}
public static bool IsValidHttpUrl(string? url)
{
if (string.IsNullOrWhiteSpace(url)) return true; // empty is allowed
if (!Uri.TryCreate(url, UriKind.Absolute, out var uri)) return false;
return uri.Scheme is "http" or "https";
}
public static async Task<bool> IsAdmin(HttpContext ctx, AppDbContext db, IConfiguration config)
{
var player = await GetAuthenticatedPlayer(ctx, db);

8
Endpoints/SuggestEndpoints.cs
View File

@@ -57,6 +57,10 @@ public static class SuggestEndpoints
{
return Results.BadRequest(new { error = "Screenshot URL could not be validated as an image." });
}
if (!EndpointHelpers.IsValidHttpUrl(request.GameUrl))
return Results.BadRequest(new { error = "Game URL must be http or https." });
if (!EndpointHelpers.IsValidHttpUrl(request.YoutubeUrl))
return Results.BadRequest(new { error = "YouTube URL must be http or https." });
if (!ValidatePlayers(request.MinPlayers, request.MaxPlayers, out var playersError))
return Results.BadRequest(new { error = playersError });
@@ -160,6 +164,10 @@ public static class SuggestEndpoints
{
return Results.BadRequest(new { error = "Screenshot URL could not be validated as an image." });
}
if (!EndpointHelpers.IsValidHttpUrl(request.GameUrl))
return Results.BadRequest(new { error = "Game URL must be http or https." });
if (!EndpointHelpers.IsValidHttpUrl(request.YoutubeUrl))
return Results.BadRequest(new { error = "YouTube URL must be http or https." });
if (!ValidatePlayers(request.MinPlayers, request.MaxPlayers, out var playersError))
return Results.BadRequest(new { error = playersError });