groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-07 09:51:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: reject non-object browse cursors

Browse source
This commit is contained in:
Jonathan Finley 2026-03-13 21:24:03 -04:00
parent f24bd19cb7
commit 6b7550c25b
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
server/utils/queries/libraryBrowseCursor.js
View file

@ -15,6 +15,10 @@ function decodeBrowseCursor(cursor) {
throw invalidBrowseCursor() throw invalidBrowseCursor()
} }
if (!decoded || typeof decoded !== 'object' || Array.isArray(decoded)) {
throw invalidBrowseCursor()
}
if (!Array.isArray(decoded.keys) || !Array.isArray(decoded.values) || decoded.keys.length !== decoded.values.length) { if (!Array.isArray(decoded.keys) || !Array.isArray(decoded.values) || decoded.keys.length !== decoded.values.length) {
throw new Error('Cursor is missing the full ordered key set') throw new Error('Cursor is missing the full ordered key set')
} }

6
test/server/utils/libraryBrowseCursor.test.js
View file

@ -59,4 +59,10 @@ describe('libraryBrowseCursor', () => {
expect(() => decodeBrowseCursor(malformedJsonCursor)).to.throw('Invalid browse cursor') expect(() => decodeBrowseCursor(malformedJsonCursor)).to.throw('Invalid browse cursor')
}) })
it('rejects decoded non-object json payloads with a controlled invalid-cursor error', () => {
const nonObjectCursor = Buffer.from('null', 'utf8').toString('base64url')
expect(() => decodeBrowseCursor(nonObjectCursor)).to.throw('Invalid browse cursor')
})
}) })