From caa12fd5cec3fed296bbb69133f26cfb8f2ad102 Mon Sep 17 00:00:00 2001
From: Nathaniel Tampus <contact@nize.ph>
Date: Mon, 6 Mar 2023 18:57:57 +0800
Subject: [PATCH] check pattern in backend as well

---
 server/src/controllers/auth.controller.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/src/controllers/auth.controller.ts b/server/src/controllers/auth.controller.ts
index 1690ff4..2e2b067 100644
--- a/server/src/controllers/auth.controller.ts
+++ b/server/src/controllers/auth.controller.ts
@@ -19,6 +19,13 @@ export const guestSession = async (req: Request, res: Response) => {
     try {
         const name = xss(req.body.name);
 
+        const pattern = /^[A-Za-z0-9_]+$/;
+
+        if (!pattern.test(name)) {
+            res.status(400).end();
+            return;
+        }
+
         if (!req.session.user || !req.session.user?.id) {
             // create guest session
             const user: User = {