From 106e2e2b318187f58b9590b573329ebabc7e62ca Mon Sep 17 00:00:00 2001 From: Shekhar Vaidya Date: Mon, 18 May 2026 12:45:27 +0530 Subject: [PATCH] fix(backend): allow non-numeric SKU IDs for legacy Windows products Replaced strconv.Atoi on sku_id with a permissive allowlist regex (alphanumeric, hyphens, underscores). Older products like Windows 8.1 (#48, #52) return non-integer SKU IDs from Microsoft API, causing the Get Download Links button to fail with 'sku_id must be a numeric value'. Closes #9 Co-Authored-By: Claude Sonnet 4.6 --- backend/main.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/main.go b/backend/main.go index 90aed7a..a3e2185 100644 --- a/backend/main.go +++ b/backend/main.go @@ -36,6 +36,7 @@ var ( cacheMutex sync.RWMutex SESSION_TTL = 15 * time.Minute workerSecret = os.Getenv("CF_WORKER_SECRET") + validSkuID = regexp.MustCompile(`^[a-zA-Z0-9_\-]+$`) ) func setWorkerSecret(req *http.Request) { @@ -312,8 +313,8 @@ func handleProxy(w http.ResponseWriter, r *http.Request) { respondJSONError(w, http.StatusBadRequest, "product_id must be a numeric value") return } - if _, err := strconv.Atoi(skuID); err != nil { - respondJSONError(w, http.StatusBadRequest, "sku_id must be a numeric value") + if !validSkuID.MatchString(skuID) { + respondJSONError(w, http.StatusBadRequest, "sku_id contains invalid characters") return }