groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-07 09:51:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: harden browse cursor validation

Browse source
This commit is contained in:
Jonathan Finley 2026-03-13 21:22:38 -04:00
parent 36170d0fcb
commit f24bd19cb7
2 changed files with 33 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
server/utils/queries/libraryBrowseCursor.js
View file

@ -2,14 +2,26 @@ function encodeBrowseCursor(payload) {
return Buffer.from(JSON.stringify(payload)).toString('base64url')
}
function invalidBrowseCursor() {
return new Error('Invalid browse cursor')
}
function decodeBrowseCursor(cursor) {
const decoded = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'))
let decoded
try {
decoded = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'))
} catch (error) {
throw invalidBrowseCursor()
}
if (!Array.isArray(decoded.keys) || !Array.isArray(decoded.values) || decoded.keys.length !== decoded.values.length) {
throw new Error('Cursor is missing the full ordered key set')
}
if (!decoded.keys.length || decoded.keys[decoded.keys.length - 1] !== 'id') {
const tieBreakerIndex = decoded.keys.length - 1
if (!decoded.keys.length || decoded.keys[tieBreakerIndex] !== 'id' || decoded.values[tieBreakerIndex] == null || decoded.values[tieBreakerIndex] === '') {
throw new Error('Cursor is missing the tie-breaker value')
}