Skip to content

Commit 46a6cad

Browse files
frasermolyneuxfrasermolyneux
committed
fix: validate Google Maps and Analytics API keys before usage in views
1 parent 4668239 commit 46a6cad

8 files changed

Lines changed: 37 additions & 21 deletions

File tree

‎src/XtremeIdiots.Portal.Integrations.Forums/AdminActionTopics.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ private string PostContent(AdminActionType type, Guid playerId, string username,
9393

9494
private int ResolveForumId(AdminActionType type, GameType gameType)
9595
{
96-
var defaultForumId = int.Parse(configuration["XtremeIdiots:Forums:DefaultForumId"] ?? "28");
96+
var defaultForumId = int.TryParse(configuration["XtremeIdiots:Forums:DefaultForumId"], out var parsedForumId) ? parsedForumId : 28;
9797

9898
var category = type switch
9999
{

‎src/XtremeIdiots.Portal.Web/Controllers/AdminActionsController.cs‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,6 @@ public class AdminActionsController(
2424
ILogger<AdminActionsController> logger,
2525
IConfiguration configuration) : BaseController(telemetryClient, logger, configuration)
2626
{
27-
private readonly string forumBaseUrl = (configuration["XtremeIdiots:Forums:TopicBaseUrl"] ?? "https://www.xtremeidiots.com/forums/topic/").TrimEnd('/') + "/";
28-
private readonly string fallbackAdminId = configuration["XtremeIdiots:Forums:DefaultAdminUserId"] ?? "21145";
29-
private readonly int tempBanDurationDays = int.TryParse(configuration["XtremeIdiots:Forums:DefaultTempBanDays"], out var days) ? days : 7;
3027

3128
/// <summary>
3229
/// Displays the create admin action form for a specific player
@@ -63,7 +60,7 @@ public async Task<IActionResult> Create(Guid id, AdminActionType adminActionType
6360
Type = adminActionType,
6461
PlayerId = playerData.PlayerId,
6562
PlayerDto = playerData,
66-
Expires = adminActionType == AdminActionType.TempBan ? DateTime.UtcNow.AddDays(tempBanDurationDays) : null
63+
Expires = adminActionType == AdminActionType.TempBan ? DateTime.UtcNow.AddDays(int.TryParse(configuration["XtremeIdiots:Forums:DefaultTempBanDays"], out var days) ? days : 7) : null
6764
};
6865

6966
return View(createAdminActionViewModel);
@@ -607,12 +604,12 @@ public async Task<IActionResult> DeleteConfirmed(Guid id, Guid playerId, Cancell
607604

608605
private string GetForumBaseUrl()
609606
{
610-
return forumBaseUrl;
607+
return (configuration["XtremeIdiots:Forums:TopicBaseUrl"] ?? "https://www.xtremeidiots.com/forums/topic/").TrimEnd('/') + "/";
611608
}
612609

613610
private string GetFallbackAdminId()
614611
{
615-
return fallbackAdminId;
612+
return configuration["XtremeIdiots:Forums:DefaultAdminUserId"] ?? "21145";
616613
}
617614

618615
private async Task<PlayerDto?> GetPlayerDataAsync(Guid playerId, CancellationToken cancellationToken = default)

‎src/XtremeIdiots.Portal.Web/Controllers/ServerAdminController.cs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,6 @@ public class ServerAdminController(
4848
ILogger<ServerAdminController> logger,
4949
IConfiguration configuration) : BaseController(telemetryClient, logger, configuration)
5050
{
51-
private readonly string forumBaseUrl = (configuration["XtremeIdiots:Forums:TopicBaseUrl"] ?? "https://www.xtremeidiots.com/forums/topic/").TrimEnd('/') + "/";
52-
private readonly string fallbackAdminId = configuration["XtremeIdiots:Forums:DefaultAdminUserId"] ?? "21145";
53-
private readonly int tempBanDurationDays = int.TryParse(configuration["XtremeIdiots:Forums:DefaultTempBanDays"], out var days) ? days : 7;
5451

5552
/// <summary>
5653
/// Displays the main server administration dashboard with available game servers
@@ -854,6 +851,8 @@ public async Task<IActionResult> TempBanRconPlayer(Guid id, int playerSlot, stri
854851
}
855852

856853
// Create admin action record with expiry if we have a GUID
854+
var tempBanDurationDays = int.TryParse(configuration["XtremeIdiots:Forums:DefaultTempBanDays"], out var days) ? days : 7;
855+
857856
if (!string.IsNullOrWhiteSpace(playerGuid))
858857
{
859858
var expiryDate = DateTime.UtcNow.AddDays(tempBanDurationDays);

‎src/XtremeIdiots.Portal.Web/Views/IPAddresses/Details.cshtml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,11 @@
309309

310310

311311
@section Scripts {
312-
@if (Model.GeoLocation != null && Model.GeoLocation.Latitude != 0 && Model.GeoLocation.Longitude != 0 && !string.IsNullOrEmpty(Configuration["Google:MapsApiKey"]))
312+
@{
313+
var mapsApiKey = Configuration["Google:MapsApiKey"];
314+
var isValidMapsApiKey = !string.IsNullOrEmpty(mapsApiKey) && System.Text.RegularExpressions.Regex.IsMatch(mapsApiKey, @"^[A-Za-z0-9_-]+$");
315+
}
316+
@if (Model.GeoLocation != null && Model.GeoLocation.Latitude != 0 && Model.GeoLocation.Longitude != 0 && isValidMapsApiKey)
313317
{
314318
<script type="text/javascript">
315319
function initMap() {
@@ -330,7 +334,7 @@
330334
});
331335
}
332336
</script>
333-
<script async defer src="https://maps.googleapis.com/maps/api/js?key=@Configuration["Google:MapsApiKey"]&signed_in=false&callback=initMap"></script>
337+
<script async defer src="https://maps.googleapis.com/maps/api/js?key=@mapsApiKey&signed_in=false&callback=initMap"></script>
334338
<script src="~/js/ip-address-details.js" asp-append-version="true"></script>
335339
}
336340
}

‎src/XtremeIdiots.Portal.Web/Views/Players/Details.cshtml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -470,9 +470,13 @@
470470
471471
</script>
472472
473-
@if (!string.IsNullOrEmpty(Configuration["Google:MapsApiKey"]))
473+
@{
474+
var mapsApiKey = Configuration["Google:MapsApiKey"];
475+
var isValidMapsApiKey = !string.IsNullOrEmpty(mapsApiKey) && System.Text.RegularExpressions.Regex.IsMatch(mapsApiKey, @"^[A-Za-z0-9_-]+$");
476+
}
477+
@if (isValidMapsApiKey)
474478
{
475-
<script async defer src="https://maps.googleapis.com/maps/api/js?key=@Configuration["Google:MapsApiKey"]&signed_in=false&callback=initMap"></script>
479+
<script async defer src="https://maps.googleapis.com/maps/api/js?key=@mapsApiKey&signed_in=false&callback=initMap"></script>
476480
}
477481
<script src="~/js/chatlog-index.js" asp-append-version="true"></script>
478482
<script src="~/js/player-details-tables.js" asp-append-version="true"></script>

‎src/XtremeIdiots.Portal.Web/Views/Servers/Map.cshtml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,13 @@
6161
}
6262
</script>
6363

64-
@if (!string.IsNullOrEmpty(Configuration["Google:MapsApiKey"]))
64+
@{
65+
var mapsApiKey = Configuration["Google:MapsApiKey"];
66+
var isValidMapsApiKey = !string.IsNullOrEmpty(mapsApiKey) && System.Text.RegularExpressions.Regex.IsMatch(mapsApiKey, @"^[A-Za-z0-9_-]+$");
67+
}
68+
@if (isValidMapsApiKey)
6569
{
6670
<script async defer
67-
src="https://maps.googleapis.com/maps/api/js?key=@Configuration["Google:MapsApiKey"]&signed_in=false&callback=initMap"></script>
71+
src="https://maps.googleapis.com/maps/api/js?key=@mapsApiKey&signed_in=false&callback=initMap"></script>
6872
}
6973
}

‎src/XtremeIdiots.Portal.Web/Views/Servers/ServerInfo.cshtml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -301,7 +301,11 @@
301301
@section Scripts {
302302
<script src="~/js/server-info.js" asp-append-version="true"></script>
303303

304-
@if (Model.GameServer.LivePlayers.Any() && !string.IsNullOrEmpty(Configuration["Google:MapsApiKey"]))
304+
@{
305+
var mapsApiKey = Configuration["Google:MapsApiKey"];
306+
var isValidMapsApiKey = !string.IsNullOrEmpty(mapsApiKey) && System.Text.RegularExpressions.Regex.IsMatch(mapsApiKey, @"^[A-Za-z0-9_-]+$");
307+
}
308+
@if (Model.GameServer.LivePlayers.Any() && isValidMapsApiKey)
305309
{
306310
<script>
307311
function initMap() {
@@ -337,7 +341,7 @@
337341
</script>
338342

339343
<script async defer
340-
src="https://maps.googleapis.com/maps/api/js?key=@Configuration["Google:MapsApiKey"]&signed_in=false&callback=initMap"></script>
344+
src="https://maps.googleapis.com/maps/api/js?key=@mapsApiKey&signed_in=false&callback=initMap"></script>
341345
}
342346

343347
<script type="text/javascript" src="https://www.gstatic.com/charts/loader.js"></script>

‎src/XtremeIdiots.Portal.Web/Views/Shared/_Layout.cshtml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,19 @@
55

66
<head>
77
<!-- Global site tag (gtag.js) - Google Analytics -->
8-
@if (!string.IsNullOrEmpty(Configuration["Google:AnalyticsId"]))
8+
@{
9+
var analyticsId = Configuration["Google:AnalyticsId"];
10+
var isValidAnalyticsId = !string.IsNullOrEmpty(analyticsId) && System.Text.RegularExpressions.Regex.IsMatch(analyticsId, @"^G-[A-Z0-9]+$");
11+
}
12+
@if (isValidAnalyticsId)
913
{
10-
<script async src="https://www.googletagmanager.com/gtag/js?id=@Configuration["Google:AnalyticsId"]"></script>
14+
<script async src="https://www.googletagmanager.com/gtag/js?id=@analyticsId"></script>
1115
<script>
1216
window.dataLayer = window.dataLayer || [];
1317
function gtag() { dataLayer.push(arguments); }
1418
gtag('js', new Date());
1519
16-
gtag('config', '@Configuration["Google:AnalyticsId"]');
20+
gtag('config', '@analyticsId');
1721
</script>
1822
}
1923

0 commit comments

Comments
 (0)