check pattern in backend as well

2023-03-06 18:57:57 +08:00
parent 6d19501ad4
commit caa12fd5ce
1 changed files with 7 additions and 0 deletions
--- a/server/src/controllers/auth.controller.ts
+++ b/server/src/controllers/auth.controller.ts
@@ -19,6 +19,13 @@ export const guestSession = async (req: Request, res: Response) => {
    try {
        const name = xss(req.body.name);

+        const pattern = /^[A-Za-z0-9_]+$/;
+
+        if (!pattern.test(name)) {
+            res.status(400).end();
+            return;
+        }
+
        if (!req.session.user || !req.session.user?.id) {
            // create guest session
            const user: User = {