From 7c68ebf183b8c3ebcd6befa97b60ed7ec9905348 Mon Sep 17 00:00:00 2001 From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com> Date: Tue, 20 Oct 2026 14:27:09 +0000 Subject: [PATCH] Reject non-hex characters in Local::from_link token Found while testing crates/collab/src/code.rs:~150 (Local::from_link, u64::from_str_radix on the token) Co-Authored-By: Claude Haiku 5.5 Co-Authored-By: Claude Sonnet 5.5 --- crates/collab/src/code.rs | 2 +- crates/collab/src/code_tests.rs | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/crates/collab/src/code.rs b/crates/collab/src/code.rs index c046682a..6eebe9f7 100644 --- a/crates/collab/src/code.rs +++ b/crates/collab/src/code.rs @@ -135,7 +135,7 @@ impl Local { let query = link.strip_prefix("figcraft://join?")?; let get = |key: &str| query.split('&').find_map(|kv| kv.split_once('=').filter(|(k, _)| *k == key).map(|(_, v)| v)); let addr: std::net::SocketAddrV4 = get("host")?.parse().ok()?; - let hex = get("token")?.strip_prefix(TOKEN_PREFIX).filter(|h| h.len() == 11)?; + let hex = get("token")?.strip_prefix(TOKEN_PREFIX).filter(|h| h.len() == 11 && h.bytes().all(|b| b.is_ascii_hexdigit()))?; let local = Local { ip: *addr.ip(), port: addr.port(), secret: u64::from_str_radix(hex, 16).ok()? }; (get("file") == Some(LOCAL_FILE) && local.port != 0).then_some(local) } diff --git a/crates/collab/src/code_tests.rs b/crates/collab/src/code_tests.rs index 2dd902b3..31bd3488 100644 --- a/crates/collab/src/code_tests.rs +++ b/crates/collab/src/code_tests.rs @@ -104,6 +104,7 @@ fn only_local_session_links_have_a_code() { "figcraft://join?host=[::1]:47900&file=local&token=local-0123456789a", "figcraft://join?host=192.168.1.20:0&file=local&token=local-0123456789a", "figcraft://join?host=192.168.1.20:47900&file=local&token=local-0123456789az", + "figcraft://join?host=10.0.0.1:47900&file=local&token=local-+0000000001", "figcraft://join?server=wss://example.org/&file=local&token=local-0123456789a", "ws://192.168.1.20:47900/?file=local&token=local-0123456789a", "",