From 76c49ebefee7db86fcb64b07debf8afa522f3d0b Mon Sep 17 00:00:00 2001
From: Roman Pominov <rpominov+github@gmail.com>
Date: Sat, 15 Oct 2022 17:51:59 +0400
Subject: [PATCH] better validation

---
 .../app/routes/rest/pages.$projectId.ts       | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/apps/designer/app/routes/rest/pages.$projectId.ts b/apps/designer/app/routes/rest/pages.$projectId.ts
index d2ce939e7a..de3913590d 100644
--- a/apps/designer/app/routes/rest/pages.$projectId.ts
+++ b/apps/designer/app/routes/rest/pages.$projectId.ts
@@ -6,23 +6,27 @@ import { z } from "zod";
 import { PutPageData } from "~/designer/features/sidebar-left/panels/pages/settings";
 import { sentryException } from "~/shared/sentry";
 
-const nonEmptyString = (fieldName: string) => {
-  const message = `${fieldName} can't be empty`;
-  return z
-    .string({ invalid_type_error: message, required_error: message })
-    .transform((v) => v.trim())
-    .refine((val) => val !== "", message);
-};
+const nonEmptyString = z
+  .string({
+    invalid_type_error: "Can't be empty",
+    required_error: "Can't be empty",
+  })
+  .transform((v) => v.trim())
+  .refine((val) => val !== "", "Can't be empty");
 
 const CreatePageInput = zfd.formData({
-  name: nonEmptyString("Page Name"),
-  path: nonEmptyString("Path")
-    .refine((path) => path !== "/", "Path can't be /")
+  name: nonEmptyString,
+  path: nonEmptyString
+    .refine((path) => path !== "/", "Can't be just a /")
     .transform((path) => (path.endsWith("/") ? path.slice(0, -1) : path))
     .transform((path) => path.replace(/\/\//g, "/"))
     .refine(
       (path) => path === "" || path.startsWith("/"),
-      "Path must start with a /"
+      "Must start with a /"
+    )
+    .refine(
+      (path) => /^[-_a-z0-9\\/]*$/.test(path),
+      "Only a-z, 0-9, -, _ and / are allowed"
     ),
 });
 
@@ -44,9 +48,7 @@ const handlePUT = async (
       errors: {
         formErrors: [],
         fieldErrors: {
-          path: [
-            `The path ${data.path} is already used for another page "${existingPage.name}"`,
-          ],
+          path: [`Already used for "${existingPage.name}"`],
         },
       },
     };