maro
82c4261a81
- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API - Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock - Reset email verification when a customer changes their email address - Fix ICS calendar injection via unescaped carriage returns in event descriptions - Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin - Move the meeting signaling token out of the WebSocket query string into the first message - Prevent duplicate signaling connections from leaking when the same participant reconnects - Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy) - Use constant-time comparison for the cron endpoint's bearer token - Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway) - Add baseline security headers and a CSP to next.config.ts - Fix CI/CD script injection via unsanitized git ref names in release.yml
78 lines
2.4 KiB
TypeScript
78 lines
2.4 KiB
TypeScript
import { BERLIN_VTIMEZONE_LINES, toBerlinICSDateTime, toUTCICSStamp } from "./timezone";
|
|
|
|
export type ICSEvent = {
|
|
uid: string;
|
|
start: Date;
|
|
end: Date;
|
|
summary: string;
|
|
description?: string;
|
|
location?: string;
|
|
url?: string;
|
|
};
|
|
|
|
function escapeICSText(value: string): string {
|
|
return value
|
|
.replace(/\\/g, "\\\\")
|
|
.replace(/;/g, "\\;")
|
|
.replace(/,/g, "\\,")
|
|
// \r must be stripped (not just \n escaped): many ICS parsers split
|
|
// lines on a bare CR too, so leaving it unescaped lets untrusted text
|
|
// (e.g. a customer's booking message ending up in DESCRIPTION) break
|
|
// out of the property value and inject extra iCalendar lines/properties.
|
|
.replace(/\r\n?/g, "\\n")
|
|
.replace(/\n/g, "\\n");
|
|
}
|
|
|
|
/** RFC 5545 line folding: lines must not exceed 75 octets; continuations start with a single space. */
|
|
function foldLine(line: string): string {
|
|
const encoder = new TextEncoder();
|
|
if (encoder.encode(line).length <= 75) return line;
|
|
|
|
const chunks: string[] = [];
|
|
let current = "";
|
|
for (const char of line) {
|
|
const candidate = current + char;
|
|
if (encoder.encode(candidate).length > 75) {
|
|
chunks.push(current);
|
|
current = char;
|
|
} else {
|
|
current = candidate;
|
|
}
|
|
}
|
|
if (current) chunks.push(current);
|
|
return chunks.join("\r\n ");
|
|
}
|
|
|
|
/** Builds a complete RFC 5545 VCALENDAR document, Europe/Berlin timezone-aware throughout. */
|
|
export function buildICSCalendar(args: { calendarName: string; events: ICSEvent[] }): string {
|
|
const lines: string[] = [
|
|
"BEGIN:VCALENDAR",
|
|
"VERSION:2.0",
|
|
"PRODID:-//ANOUMA//Calendar Feed//DE",
|
|
"CALSCALE:GREGORIAN",
|
|
"METHOD:PUBLISH",
|
|
`X-WR-CALNAME:${escapeICSText(args.calendarName)}`,
|
|
"X-WR-TIMEZONE:Europe/Berlin",
|
|
...BERLIN_VTIMEZONE_LINES,
|
|
];
|
|
|
|
const stamp = toUTCICSStamp(new Date());
|
|
for (const ev of args.events) {
|
|
lines.push(
|
|
"BEGIN:VEVENT",
|
|
`UID:${ev.uid}`,
|
|
`DTSTAMP:${stamp}`,
|
|
`DTSTART;TZID=Europe/Berlin:${toBerlinICSDateTime(ev.start)}`,
|
|
`DTEND;TZID=Europe/Berlin:${toBerlinICSDateTime(ev.end)}`,
|
|
`SUMMARY:${escapeICSText(ev.summary)}`,
|
|
);
|
|
if (ev.description) lines.push(`DESCRIPTION:${escapeICSText(ev.description)}`);
|
|
if (ev.location) lines.push(`LOCATION:${escapeICSText(ev.location)}`);
|
|
if (ev.url) lines.push(`URL:${ev.url}`);
|
|
lines.push("STATUS:CONFIRMED", "END:VEVENT");
|
|
}
|
|
|
|
lines.push("END:VCALENDAR");
|
|
return lines.map(foldLine).join("\r\n") + "\r\n";
|
|
}
|