groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-07 09:51:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: reject non-object browse cursors

Browse source
This commit is contained in:
Jonathan Finley 2026-03-13 21:24:03 -04:00
parent f24bd19cb7
commit 6b7550c25b
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
server/utils/queries/libraryBrowseCursor.js
View file

@ -15,6 +15,10 @@ function decodeBrowseCursor(cursor) {
throw invalidBrowseCursor()
}
if (!decoded || typeof decoded !== 'object' || Array.isArray(decoded)) {
throw invalidBrowseCursor()
}
if (!Array.isArray(decoded.keys) || !Array.isArray(decoded.values) || decoded.keys.length !== decoded.values.length) {
throw new Error('Cursor is missing the full ordered key set')
}