shekhar/windows-iso-downloader
1
0
Fork 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

fix(backend): allow non-numeric SKU IDs for legacy Windows products

Browse source 
Replaced strconv.Atoi on sku_id with a permissive allowlist regex
(alphanumeric, hyphens, underscores). Older products like Windows 8.1
(#48, #52) return non-integer SKU IDs from Microsoft API, causing the
Get Download Links button to fail with 'sku_id must be a numeric value'.

Closes #9
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Shekhar Vaidya 2026-05-18 12:45:27 +05:30
parent e7b0fea94b
commit 106e2e2b31
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
backend/main.go
View file

@ -36,6 +36,7 @@ var (
cacheMutex sync.RWMutex
SESSION_TTL = 15 * time.Minute
workerSecret = os.Getenv("CF_WORKER_SECRET")
validSkuID = regexp.MustCompile(`^[a-zA-Z0-9_\-]+$`)
)
func setWorkerSecret(req *http.Request) {
@ -312,8 +313,8 @@ func handleProxy(w http.ResponseWriter, r *http.Request) {
respondJSONError(w, http.StatusBadRequest, "product_id must be a numeric value")
return
}
if _, err := strconv.Atoi(skuID); err != nil {
respondJSONError(w, http.StatusBadRequest, "sku_id must be a numeric value")
if !validSkuID.MatchString(skuID) {
respondJSONError(w, http.StatusBadRequest, "sku_id contains invalid characters")
return
}