fix(security): escape path parameters

This commit is contained in:
Vlad Frangu
2024-11-21 22:40:24 +02:00
parent 00954701e8
commit 1ba3472938
8 changed files with 132 additions and 0 deletions

View File

@@ -1053,6 +1053,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const StickerPackApplicationId = '710982414301790216';
export enum ImageFormat {
@@ -1350,6 +1361,17 @@ export const CDNRoutes = {
},
};
for (const [key, fn] of Object.entries(CDNRoutes)) {
CDNRoutes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(CDNRoutes);
export type DefaultUserAvatarAssets = 0 | 1 | 2 | 3 | 4 | 5;
export type EmojiFormat = Exclude<ImageFormat, ImageFormat.Lottie>;

View File

@@ -519,3 +519,14 @@ export const Routes = {
return `/oauth2/applications/@me`;
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);

View File

@@ -777,6 +777,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const RouteBases = {
api: `https://discord.com/api/v${APIVersion}`,
cdn: 'https://cdn.discordapp.com',

View File

@@ -1062,6 +1062,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const StickerPackApplicationId = '710982414301790216';
export enum ImageFormat {
@@ -1359,6 +1370,17 @@ export const CDNRoutes = {
},
};
for (const [key, fn] of Object.entries(CDNRoutes)) {
CDNRoutes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(CDNRoutes);
export type DefaultUserAvatarAssets = 0 | 1 | 2 | 3 | 4 | 5;
export type EmojiFormat = Exclude<ImageFormat, ImageFormat.Lottie>;

View File

@@ -1053,6 +1053,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const StickerPackApplicationId = '710982414301790216';
export enum ImageFormat {
@@ -1350,6 +1361,17 @@ export const CDNRoutes = {
},
};
for (const [key, fn] of Object.entries(CDNRoutes)) {
CDNRoutes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(CDNRoutes);
export type DefaultUserAvatarAssets = 0 | 1 | 2 | 3 | 4 | 5;
export type EmojiFormat = Exclude<ImageFormat, ImageFormat.Lottie>;

View File

@@ -519,3 +519,14 @@ export const Routes = {
return `/oauth2/applications/@me`;
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);

View File

@@ -777,6 +777,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const RouteBases = {
api: `https://discord.com/api/v${APIVersion}`,
cdn: 'https://cdn.discordapp.com',

View File

@@ -1062,6 +1062,17 @@ export const Routes = {
},
};
for (const [key, fn] of Object.entries(Routes)) {
Routes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(Routes);
export const StickerPackApplicationId = '710982414301790216';
export enum ImageFormat {
@@ -1359,6 +1370,17 @@ export const CDNRoutes = {
},
};
for (const [key, fn] of Object.entries(CDNRoutes)) {
CDNRoutes[key] = (...args: string[]) => {
const escaped = args.map((arg) => encodeURIComponent(arg));
// eslint-disable-next-line no-useless-call
return fn.call(null, ...escaped);
};
}
// Freeze the object so it can't be changed
Object.freeze(CDNRoutes);
export type DefaultUserAvatarAssets = 0 | 1 | 2 | 3 | 4 | 5;
export type EmojiFormat = Exclude<ImageFormat, ImageFormat.Lottie>;