diff --git a/ipe/websockets.go b/ipe/websockets.go index 5994e2b..c439654 100644 --- a/ipe/websockets.go +++ b/ipe/websockets.go @@ -118,6 +118,11 @@ func onMessage(conn *websocket.Conn, w http.ResponseWriter, r *http.Request, ses channelName := strings.TrimSpace(subscribeEvent.Data.Channel) + if !utils.IsChannelNameValid(channelName) { + emitWSError(newGenericError(fmt.Sprintf("This channel name is not valid")), conn) + break + } + isPresence := strings.HasPrefix(channelName, "presence-") isPrivate := strings.HasPrefix(channelName, "private-") diff --git a/utils/utils.go b/utils/utils.go index 157f40c..c628900 100644 --- a/utils/utils.go +++ b/utils/utils.go @@ -10,6 +10,7 @@ import ( "encoding/hex" "fmt" "math/rand" + "regexp" "time" ) @@ -29,3 +30,17 @@ func GenerateSessionID() string { return fmt.Sprintf("%d.%d", rand.Intn(MAX), rand.Intn(MAX)) } + +func IsChannelNameValid(channelName string) bool { + matched, err := regexp.MatchString("^[A-Za-z0-9_\\-=@,.;]+$", channelName) + + if err != nil { + return false + } + + if matched { + return true + } + + return false +} diff --git a/utils/utils_test.go b/utils/utils_test.go index b62321b..bd99e88 100644 --- a/utils/utils_test.go +++ b/utils/utils_test.go @@ -18,3 +18,21 @@ func TestGenerateSession(t *testing.T) { t.Errorf("Must match ^\\d+\\.\\d+$, value: '%s'", sessionID) } } + +func TestIsValidChannelName(t *testing.T) { + if IsChannelNameValid("#@#hhh**sasas") { + t.Errorf("Invalid Channel Name") + } + + if !IsChannelNameValid("private-hello") { + t.Errorf("Must be Valid Channel Name") + } + + if !IsChannelNameValid("presence-hello") { + t.Errorf("Must be Valid Channel Name") + } + + if !IsChannelNameValid("public") { + t.Errorf("Must be Valid Channel Name") + } +}