also looking at this
fix: validate site domain before it reaches nginx server_name
#129
5 files
+143
-5
| @@ -236,7 +236,16 @@ export function renderSiteSnippet(input: Omit<AddSiteConfigInput, 'configText'>) | ||
| 236 | 236 | } |
| 237 | 237 | |
| 238 | 238 | function escapeSingle(value: string): string { |
| 239 | return value.replace(/\\/g, '\\\\').replaceAll(String.fromCharCode(39), '\\\'') | |
| 239 | // Newlines matter as much as quotes here: these values land in single-quoted | |
| 240 | // TS string literals in the shared, box-wide cloud.config.ts. A raw newline | |
| 241 | // terminates the literal and leaves the file syntactically broken for every | |
| 242 | // tenant that loads it. It also keeps line-oriented sinks downstream (heredoc | |
| 243 | // delimiters in the deploy script) safe from values that span lines. | |
| 244 | return value | |
| 245 | .replace(/\\/g, '\\\\') | |
| 246 | .replaceAll(String.fromCharCode(39), '\\\'') | |
| 247 | .replace(/\r/g, '\\r') | |
| 248 | .replace(/\n/g, '\\n') | |
| 240 | 249 | } |
| 241 | 250 | |
| 242 | 251 | function normalizeSiteName(name: string): string { |