FIX #798 - subscription can be deleted even with special caracter in …

…custom name
MAIF · Jan 24, 2025 · cb4c1d7 · cb4c1d7
1 parent 22de934
commit cb4c1d7
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/daikoku/javascript/src/components/backoffice/apikeys/TeamApiKeysForApi.tsx b/daikoku/javascript/src/components/backoffice/apikeys/TeamApiKeysForApi.tsx
@@ -29,6 +29,7 @@ import {
   PaginatedComponent,
   Spinner,
   apikey,
+  escapeRegExp,
   formatPlanType,
   read
 } from '../../utils';
@@ -266,7 +267,7 @@ export const TeamApiKeysForApi = () => {
                 label: translate({ key: "apikeys.delete.confirm.label", replacements: [`${subscription.apiName}/${subscription.customName ?? subscription.planName}`] }),
                 constraints: [
                   constraints.required(translate('constraints.required.value')),
-                  constraints.matches(new RegExp(`${subscription.apiName}/${subscription.customName ?? subscription.planName}`), translate('constraints.match.subscription'))
+                  constraints.matches(new RegExp(`${escapeRegExp(subscription.apiName)}/${escapeRegExp(subscription.customName) ?? escapeRegExp(subscription.planName)}`), translate('constraints.match.subscription'))
                 ],
                 defaultValue: ""
               }

diff --git a/daikoku/javascript/src/components/utils/function.tsx b/daikoku/javascript/src/components/utils/function.tsx
@@ -124,3 +124,14 @@ export const teamGQLToSimple = (team: ITeamFullGql): ITeamSimple => {
     users: team.users.map(({ user, teamPermission }) => ({ userId: user?.userId, teamPermission }))
   })
 }
+
+/**
+ * Escapes special characters in a string so it can be safely used in a regular expression.
+ * Escaped characters: . * + ? ^ $ { } ( ) | [ ] \ /
+ *
+ * @param {string} string - The string to escape.
+ * @returns {string} - The escaped string, safe for use in a regular expression.
+ */
+export const escapeRegExp = (string) => {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // Échappe tous les caractères spéciaux
+}