Improve data validation for channel names

src/endpoints/files/file_server.ts

@@ -1,16 +1,24 @@
 import { ServerRoute } from "@hapi/hapi";
 import { log } from "$/main";
 import path from "path";
+import Joi from "joi";
+import { channelSchema } from "$/schemas/general";
 
 const route: ServerRoute = {
 	method: `GET`, path: `/{channel}/overlay/{theme}/{path*}`,
 	options: {
+		validate: {
+			params: Joi.object({
+				channel: channelSchema,
+				theme: Joi.string().pattern(/^[a-z0-9\-]+$/),
+				path: Joi.string().optional(),
+			}),
+		},
 		files: {
 			relativeTo: path.join(process.cwd(), `site`),
 		},
 	},
 	handler(request, h) {
-		// const theme = request.query.theme;
 		const path = request.params.path;
 		const theme = request.params.theme.replace(/\-/g, `/`);
 

src/endpoints/new_game.ts

@@ -1,4 +1,5 @@
 import { anonymizePhrase, convertToKey, spacePhrase } from "$/utils/game";
+import { channelSchema } from "$/schemas/general";
 import { config, database } from "$/main";
 import { ServerRoute } from "@hapi/hapi";
 import { readFileSync } from "fs";
@@ -10,7 +11,7 @@ const route: ServerRoute = {
 	options: {
 		validate: {
 			params: Joi.object({
-				channel: Joi.string().alphanum(),
+				channel: channelSchema,
 			}),
 			query: Joi.object({
 				word_list: Joi.string(),

src/endpoints/setup_channel.ts

@@ -1,5 +1,6 @@
-import { database } from "$/main";
+import { channelSchema } from "$/schemas/general";
 import { ServerRoute } from "@hapi/hapi";
+import { database } from "$/main";
 import Joi from "joi";
 
 const route: ServerRoute = {
@@ -7,7 +8,7 @@ const route: ServerRoute = {
 	options: {
 		validate: {
 			payload: Joi.object({
-				channel: Joi.string().alphanum(),
+				channel: channelSchema,
 			}),
 		},
 	},

src/endpoints/view_game_state.ts

@@ -1,3 +1,4 @@
+import { channelSchema } from "$/schemas/general";
 import { config, database } from "$/main";
 import { ServerRoute } from "@hapi/hapi";
 import Joi from "joi";
@@ -7,7 +8,7 @@ const route: ServerRoute = {
 	options: {
 		validate: {
 			params: Joi.object({
-				channel: Joi.string().alphanum(),
+				channel: channelSchema,
 			}),
 		},
 	},

src/schemas/general.ts

@@ -0,0 +1,3 @@
+import Joi from "joi";
+
+export const channelSchema = Joi.string().pattern(/^[a-z0-9_\-]$/i);