[mirotalk] - improvements

app/src/server.js

@@ -39,7 +39,7 @@ dependencies: {
  * @license For commercial use or closed source, contact us at license.mirotalk@gmail.com or purchase directly from CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.4.50
+ * @version 1.4.51
  *
  */
 

package.json

@@ -1,6 +1,6 @@
 {
     "name": "mirotalk",
-    "version": "1.4.50",
+    "version": "1.4.51",
     "description": "A free WebRTC browser-based video call",
     "main": "server.js",
     "scripts": {

public/js/client.js

@@ -15,7 +15,7 @@
  * @license For commercial use or closed source, contact us at license.mirotalk@gmail.com or purchase directly from CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.4.50
+ * @version 1.4.51
  *
  */
 
@@ -11036,7 +11036,7 @@ function showAbout() {
     Swal.fire({
         background: swBg,
         position: 'center',
-        title: '<strong>WebRTC P2P v1.4.50</strong>',
+        title: '<strong>WebRTC P2P v1.4.51</strong>',
         imageAlt: 'mirotalk-about',
         imageUrl: images.about,
         customClass: { image: 'img-about' },

public/js/common.js

@@ -220,13 +220,28 @@ function getUUID4() {
 }
 
 function joinRoom() {
-    const roomName = filterXSS(document.getElementById('roomName').value);
-    if (roomName) {
-        window.location.href = '/join/' + roomName;
-        window.localStorage.lastRoom = roomName;
-    } else {
+    const roomName = filterXSS(document.getElementById('roomName').value).trim().replace(/\s+/g, '-');
+    const roomValid = isValidRoomName(roomName);
+
+    if (!roomName) {
         popup('warning', 'Room name empty!\nPlease pick a room name.');
+        return;
     }
+    if (!roomValid) {
+        popup('warning', 'Invalid Room name!\nPath traversal pattern detected!');
+        return;
+    }
+
+    window.location.href = '/join/' + roomName;
+    window.localStorage.lastRoom = roomName;
+}
+
+function isValidRoomName(input) {
+    if (typeof input !== 'string') {
+        return false;
+    }
+    const pathTraversalPattern = /(\.\.(\/|\\))+/;
+    return !pathTraversalPattern.test(input);
 }
 
 function adultContent() {

public/js/utils.js

@@ -12,4 +12,4 @@ function popup(icon, text, position = 'center') {
         hideClass: { popup: 'animate__animated animate__fadeOutUp' },
     });
 }
-//...
+//...