This commit is contained in:
Andras Schmelczer 2026-05-14 22:07:14 +01:00
parent 084117cea8
commit a8de0a614d
36 changed files with 1329 additions and 522 deletions

View file

@ -14,6 +14,7 @@ const NUMERIC_RE = /^-?(?:\d+|\d*\.\d+)$/;
const PATH_RE = /^\/(?:invite\/[A-Za-z0-9]{1,20})?$/;
const QUERY_KEY_RE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
const SAFE_VALUE_RE = /^[^\u0000-\u001f\u007f]+$/;
const SUPPORTED_LANGUAGES = new Set(['en', 'fr', 'de', 'zh', 'hi', 'hu']);
const REPEATED_KEYS = [
'filter',
'school',
@ -78,6 +79,16 @@ function assertSafeKey(key: string): void {
}
}
function toSupportedLanguage(value: string): string | null {
const lower = value.toLowerCase();
if (SUPPORTED_LANGUAGES.has(lower)) return lower;
const prefix = lower.split('-')[0];
if (SUPPORTED_LANGUAGES.has(prefix)) return prefix;
return null;
}
function appendSafeValues(qs: URLSearchParams, query: Query, key: string): void {
assertSafeKey(key);
for (const value of repeatedStrings(query, key)) {
@ -118,6 +129,7 @@ export function buildScreenshotRequest(query: Query): ValidatedScreenshotRequest
'zoom',
'tab',
'og',
'lang',
'path',
...PASSTHROUGH_SINGLE_KEYS,
...REPEATED_KEYS,
@ -143,6 +155,16 @@ export function buildScreenshotRequest(query: Query): ValidatedScreenshotRequest
qs.set('og', og);
}
const lang = firstString(query, 'lang');
if (lang != null) {
assertSafeValue('lang', lang);
const supported = toSupportedLanguage(lang);
if (!supported) {
validationError('lang is invalid');
}
qs.set('lang', supported);
}
for (const key of PASSTHROUGH_SINGLE_KEYS) {
const value = firstString(query, key);
if (value == null) continue;