From 8e5293f0102da48410a3d184b709c6e53d97a0bb Mon Sep 17 00:00:00 2001 From: dreamhunter2333 Date: Thu, 4 Sep 2025 02:06:53 +0800 Subject: [PATCH] fix: enhance input validation with trim() for address creation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add trim() handling in newAddress() function to prevent whitespace issues - Add trim() handling for address prefixes to ensure consistent formatting - Add trim() handling in Telegram API address parsing for robustness - Prevents edge cases with whitespace-only or padded input strings 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- worker/src/common.ts | 8 ++++---- worker/src/telegram_api/common.ts | 5 +++-- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/worker/src/common.ts b/worker/src/common.ts index 9e4ae030..07652a84 100644 --- a/worker/src/common.ts +++ b/worker/src/common.ts @@ -101,8 +101,8 @@ export const newAddress = async ( enableCheckNameRegex?: boolean, } ): Promise<{ address: string, jwt: string }> => { - // remove special characters - name = name.replace(getNameRegex(c), '') + // trim whitespace and remove special characters + name = name.trim().replace(getNameRegex(c), '') // check name if (enableCheckNameRegex) { await checkNameBlockList(c, name); @@ -127,9 +127,9 @@ export const newAddress = async ( } // create address with prefix if (typeof addressPrefix === "string") { - name = addressPrefix + name; + name = addressPrefix.trim() + name; } else if (enablePrefix) { - name = getStringValue(c.env.PREFIX) + name; + name = getStringValue(c.env.PREFIX).trim() + name; } // check domain const allowDomains = checkAllowDomains ? await getAllowDomains(c) : getDomains(c); diff --git a/worker/src/telegram_api/common.ts b/worker/src/telegram_api/common.ts index 51534052..3a075dce 100644 --- a/worker/src/telegram_api/common.ts +++ b/worker/src/telegram_api/common.ts @@ -18,8 +18,9 @@ export const tgUserNewAddress = async ( // Check if custom address names are disabled const disableCustomAddressName = getBooleanValue(c.env.DISABLE_CUSTOM_ADDRESS_NAME); - // Parse address parameter - const [name, domain] = address.includes("@") ? address.split("@") : [address, null]; + // Parse address parameter - handle empty or whitespace-only address + const trimmedAddress = address ? address.trim() : ""; + const [name, domain] = trimmedAddress.includes("@") ? trimmedAddress.split("@") : [trimmedAddress, null]; const jwtList = await c.env.KV.get(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, 'json') || []; if (jwtList.length >= getIntValue(c.env.TG_MAX_ADDRESS, 5)) { throw Error("绑定地址数量已达上限");