From 8936049a818c4ce23fe75a83d4384032bbdc13da Mon Sep 17 00:00:00 2001 From: Maurice Date: Tue, 22 Sep 2026 09:56:13 +0200 Subject: [PATCH] fix(client): take the reported version as one anchored match before storing it The dev branch gate on SonarCloud has been red since the 4.3.0 cycle on this one line: the version from /api/config is written to localStorage, and the taint engine did not read the replace() plus equality check as sanitisation (S8475). The value is the match of ^[\w.+-]{1,64}$ now, the same characters and length as before, in the shape the engine recognises. --- client/src/App.tsx | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/client/src/App.tsx b/client/src/App.tsx index 9d27ac6d1..e4c72ab8e 100644 --- a/client/src/App.tsx +++ b/client/src/App.tsx @@ -320,14 +320,13 @@ export default function App() { if (config?.permissions) usePermissionsStore.getState().setPermissions(config.permissions) // A version is a short release tag and nothing else. It arrives over the - // wire and is written to this device's storage, so it is rebuilt from the - // characters a tag may contain and kept only when nothing had to be - // stripped. Anything else is ignored, which also keeps a malformed value - // from being compared against the stored marker and starting an update on - // every launch. - const reportedVersion = typeof config?.version === 'string' ? config.version : '' - const version = reportedVersion.replace(/[^\w.+-]/g, '').slice(0, 64) - if (version && version === reportedVersion) { + // wire and is written to this device's storage, so only a value made of + // the characters a tag may contain is taken, as the match itself. Anything + // else is ignored, which also keeps a malformed value from being compared + // against the stored marker and starting an update on every launch. + const releaseTag = /^[\w.+-]{1,64}$/.exec(typeof config?.version === 'string' ? config.version : '') + if (releaseTag) { + const version = releaseTag[0] const storedVersion = localStorage.getItem('trek_app_version') // Record the version BEFORE acting on it. The old code wrote the marker // after the purge and outside its try, so a throwing setItem (private