fix(web): allow ?lang and /logs through prod API proxy allowlist

2026-06-18 00:43:39 -07:00
parent 8158a878db
commit ae7adcce18
1 changed files with 9 additions and 0 deletions
@@ -1586,6 +1586,15 @@ function allowedApiTarget(req) {
  }

  if (/^\/api\/tss\/games\/[A-Za-z0-9_-]{1,96}$/.test(pathname)) {
+    const keys = [...params.keys()]
+    const lang = params.get('lang') || 'en'
+    if (keys.some((key) => key !== 'lang') || !/^[A-Za-z-]{2,8}$/.test(lang)) {
+      return null
+    }
+    return url
+  }
+
+  if (/^\/api\/tss\/games\/[A-Za-z0-9_-]{1,96}\/logs$/.test(pathname)) {
    if ([...params.keys()].length) return null
    return url
  }