jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-14 13:22:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate contract route ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:58:28 +01:00
parent f7ab77dec5
commit badd0b1b47
3 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/service.go
+6 -4
View File
@@ -470,7 +470,7 @@ func (s *Service) contractQueueCreate(w http.ResponseWriter, r *http.Request) {
func (s *Service) contractQueueMutation(w http.ResponseWriter, r *http.Request) {
path := strings.TrimPrefix(r.URL.Path, "/api/v1/queue/tickets/")
parts := strings.Split(path, "/")
if path == "" || len(parts) > 2 || parts[0] == "" || (len(parts) == 2 && parts[1] != "heartbeat") {
if path == "" || len(parts) > 2 || !controlPlaneResourceIDRE.MatchString(parts[0]) || (len(parts) == 2 && parts[1] != "heartbeat") {
writeError(w, http.StatusNotFound, "not_found")
return
}
@@ -493,7 +493,8 @@ func (s *Service) contractQueueMutation(w http.ResponseWriter, r *http.Request)
func (s *Service) contractProposalMutation(w http.ResponseWriter, r *http.Request) {
path := strings.TrimPrefix(r.URL.Path, "/api/v1/proposals/")
if path == "" {
parts := strings.Split(path, "/")
if path == "" || len(parts) > 2 || !controlPlaneResourceIDRE.MatchString(parts[0]) {
writeError(w, http.StatusNotFound, "not_found")
return
}
@@ -504,7 +505,7 @@ func (s *Service) contractProposalMutation(w http.ResponseWriter, r *http.Reques
func (s *Service) contractAssignment(w http.ResponseWriter, r *http.Request) {
path := strings.TrimPrefix(r.URL.Path, "/api/v1/assignments/")
if path == "" || strings.Contains(path, "/") {
if path == "" || strings.Contains(path, "/") || !controlPlaneResourceIDRE.MatchString(path) {
writeError(w, http.StatusNotFound, "not_found")
return
}
@@ -520,7 +521,8 @@ func (s *Service) contractServerMutation(w http.ResponseWriter, r *http.Request)
// any "/" would 404 every real call. Delegate shape validation to
// serverMutation, which already enforces exactly {id}/{result|register}.
path := strings.TrimPrefix(r.URL.Path, "/api/v1/servers/")
if path == "" {
parts := strings.Split(path, "/")
if path == "" || len(parts) < 2 || !controlPlaneResourceIDRE.MatchString(parts[0]) {
writeError(w, http.StatusNotFound, "not_found")
return
}