From f150c223bce473db9644cd867aff740ed9cc73a7 Mon Sep 17 00:00:00 2001
From: zadam <zadam.apps@gmail.com>
Date: Thu, 29 Dec 2022 10:25:49 +0100
Subject: [PATCH] improved ZIP import validation and error handling

---
 src/etapi/validators.js    | 18 +++++++++---------
 src/services/export/zip.js |  4 ++--
 src/services/import/zip.js | 15 +++++++++++++++
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/src/etapi/validators.js b/src/etapi/validators.js
index 7b3ba852c..f02d6a4ab 100644
--- a/src/etapi/validators.js
+++ b/src/etapi/validators.js
@@ -16,7 +16,7 @@ function isString(obj) {
     if (obj === undefined || obj === null) {
         return;
     }
-    
+
     if (typeof obj !== 'string') {
         return `'${obj}' is not a string`;
     }
@@ -26,7 +26,7 @@ function isBoolean(obj) {
     if (obj === undefined || obj === null) {
         return;
     }
-    
+
     if (typeof obj !== 'boolean') {
         return `'${obj}' is not a boolean`;
     }
@@ -36,7 +36,7 @@ function isInteger(obj) {
     if (obj === undefined || obj === null) {
         return;
     }
-    
+
     if (!Number.isInteger(obj)) {
         return `'${obj}' is not an integer`;
     }
@@ -46,13 +46,13 @@ function isNoteId(obj) {
     if (obj === undefined || obj === null) {
         return;
     }
-    
+
     const becca = require('../becca/becca');
-    
+
     if (typeof obj !== 'string') {
         return `'${obj}' is not a valid noteId`;
     }
-    
+
     if (!(obj in becca.notes)) {
         return `Note '${obj}' does not exist`;
     }
@@ -84,8 +84,8 @@ function isValidEntityId(obj) {
     if (obj === undefined || obj === null) {
         return;
     }
-    
-    if (typeof obj !== 'string' || !/^[A-Za-z0-9]{4,32}$/.test(obj)) {
+
+    if (typeof obj !== 'string' || !/^[A-Za-z0-9_]{4,128}$/.test(obj)) {
         return `'${obj}' is not a valid entityId. Only alphanumeric characters are allowed of length 4 to 32.`;
     }
 }
@@ -100,4 +100,4 @@ module.exports = {
     isNoteType,
     isAttributeType,
     isValidEntityId
-};
\ No newline at end of file
+};
diff --git a/src/services/export/zip.js b/src/services/export/zip.js
index 9b73d1b8c..3fdaa2dd5 100644
--- a/src/services/export/zip.js
+++ b/src/services/export/zip.js
@@ -214,13 +214,13 @@ function exportToZip(taskContext, branch, format, res) {
     }
 
     function findLinks(content, noteMeta) {
-        content = content.replace(/src="[^"]*api\/images\/([a-zA-Z0-9]+)\/[^"]*"/g, (match, targetNoteId) => {
+        content = content.replace(/src="[^"]*api\/images\/([a-zA-Z0-9_]+)\/[^"]*"/g, (match, targetNoteId) => {
             const url = getTargetUrl(targetNoteId, noteMeta);
 
             return url ? `src="${url}"` : match;
         });
 
-        content = content.replace(/href="[^"]*#root[a-zA-Z0-9\/]*\/([a-zA-Z0-9]+)\/?"/g, (match, targetNoteId) => {
+        content = content.replace(/href="[^"]*#root[a-zA-Z0-9_\/]*\/([a-zA-Z0-9_]+)\/?"/g, (match, targetNoteId) => {
             const url = getTargetUrl(targetNoteId, noteMeta);
 
             return url ? `href="${url}"` : match;
diff --git a/src/services/import/zip.js b/src/services/import/zip.js
index c8913b67c..45a78a190 100644
--- a/src/services/import/zip.js
+++ b/src/services/import/zip.js
@@ -231,6 +231,13 @@ async function importZip(taskContext, fileBuffer, importRootNote) {
         absUrl += `${absUrl.length > 0 ? '/' : ''}${url}`;
 
         const {noteMeta} = getMeta(absUrl);
+
+        if (!noteMeta) {
+            log.info(`Could not find note meta for URL '${absUrl}'.`);
+
+            return null;
+        }
+
         const targetNoteId = getNoteId(noteMeta, absUrl);
         return targetNoteId;
     }
@@ -312,6 +319,10 @@ async function importZip(taskContext, fileBuffer, importRootNote) {
 
                 const targetNoteId = getNoteIdFromRelativeUrl(url, filePath);
 
+                if (!targetNoteId) {
+                    return match;
+                }
+
                 return `src="api/images/${targetNoteId}/${path.basename(url)}"`;
             });
 
@@ -329,6 +340,10 @@ async function importZip(taskContext, fileBuffer, importRootNote) {
 
                 const targetNoteId = getNoteIdFromRelativeUrl(url, filePath);
 
+                if (!targetNoteId) {
+                    return match;
+                }
+
                 return `href="#root/${targetNoteId}"`;
             });