fix(add-window): harden intake admission and destination safety

- retain valid magnet clipboard handoffs and reject malformed magnet URLs

- normalize destination identity and fail closed on deleted queues

- redact malformed media headers and add focused regression coverage
This commit is contained in:
NimBold
2026-08-22 01:25:10 +03:30
parent 1672dce803
commit 3a740db2f2
7 changed files with 83 additions and 7 deletions
+8 -1
View File
@@ -307,7 +307,14 @@ export const downloadLocationEquals = (
os: string
): boolean => {
const normalize = (value: string) => {
const normalized = value.replace(/\\/g, '/').replace(/\/+$/, '');
const slashPath = value.replace(/\\/g, '/');
// Collapse redundant separators without destroying a Windows UNC prefix.
// Destination strings can come from legacy settings as well as the folder
// picker, so lexical equality must not miss the same filesystem target.
const leadingSeparators = slashPath.match(/^\/+/);
const leadingCount = leadingSeparators ? leadingSeparators[0].length : 0;
const prefix = os === 'windows' && leadingCount >= 2 ? '//' : leadingCount > 0 ? '/' : '';
const normalized = `${prefix}${slashPath.slice(leadingCount).replace(/\/{2,}/g, '/')}`.replace(/\/+$/, '');
return os === 'windows'
? normalized.toLocaleLowerCase()
: normalized;