fix: further sanitize fav cookies (#481)

cypress/integration/homepage.test.ts

@@ -71,6 +71,10 @@ describe('Homepage', () => {
     cy.setCookie('favs', oldFFMCookie);
     cy.visit('/');
     cy.findByTestId('favEntry').should('have.text', 'Frankfurt(Main)Hbf');
-    cy.getCookie('favs').should('have.property', 'value', currentFFMCookie);
+    cy.getCookie('favs').should(
+      'have.property',
+      'value',
+      decodeURIComponent(currentFFMCookie),
+    );
   });
 });

cypress/integration/routing/routing.test.ts

@@ -44,7 +44,11 @@ describe('Routing', () => {
       cy.setCookie('rfavs', oldFavCookie);
       cy.visit('/routing');
       cy.findByTestId('RouteFavEntry-80001918000105').should('exist');
-      cy.getCookie('rfavs').should('have.property', 'value', favCookie);
+      cy.getCookie('rfavs').should(
+        'have.property',
+        'value',
+        decodeURIComponent(favCookie),
+      );
     });
 
     it('can load fav from cookie', () => {

packages/client/Abfahrten/provider/FavProvider.tsx

@@ -92,22 +92,6 @@ export const FavProvider: FC<Props> = ({
 }) => {
   const storage = useStorage();
   const savedFavs = storage.get(storageKey);
-  if (savedFavs) {
-    Object.keys(savedFavs).forEach((favKey) => {
-      // @ts-expect-error old format had this
-      const fav: {
-        title: string;
-        id: string;
-      } = savedFavs[favKey];
-      if (fav.id) {
-        savedFavs[favKey] = {
-          name: fav.title,
-          evaNumber: fav.id,
-        };
-      }
-    });
-    storage.set(storageKey, savedFavs);
-  }
 
   return (
     <InnerFavProvider

packages/client/Common/Storage.ts

@@ -36,23 +36,6 @@ export class ClientStorage extends ServerStorage {
   get<K extends keyof WebConfigMap>(name: K): WebConfigMap[K] | undefined {
     const cookieGet = super.get(name);
     if (cookieGet != null) return cookieGet;
-    const storageGet = localStorage.getItem(name);
-    if (storageGet) {
-      try {
-        const value = JSON.parse(storageGet);
-        super.set(name, value);
-      } catch {
-        // ignored, fallback failed
-      }
-    }
     return undefined;
   }
-  set<K extends keyof WebConfigMap>(name: K, value: WebConfigMap[K]): void {
-    super.set(name, value);
-    localStorage.setItem(name, JSON.stringify(value));
-  }
-  remove(name: string): void {
-    super.remove(name);
-    localStorage.removeItem(name);
-  }
 }

packages/client/Routing/provider/RoutingFavProvider.tsx

@@ -82,39 +82,10 @@ export const [
   }),
 );
 
-type OldFavStopPlace = {
-  title: string;
-  id: string;
-};
-
-function migrateOldFav(old: OldFavStopPlace): MinimalStopPlace {
-  return {
-    name: old.title,
-    evaNumber: old.id.length > 7 ? old.id.substring(2) : old.id,
-  };
-}
-
 export const RoutingFavProvider: FC = ({ children }) => {
   const storage = useStorage();
   const savedRoutingFavs = storage.get('rfavs');
-  if (savedRoutingFavs) {
-    Object.keys(savedRoutingFavs).forEach((favKey) => {
-      // @ts-expect-error old format had this
-      const fav: {
-        start: OldFavStopPlace;
-        destination: OldFavStopPlace;
-        via: OldFavStopPlace[];
-      } = savedRoutingFavs[favKey];
-      if (fav.start.id) {
-        savedRoutingFavs[favKey] = {
-          start: migrateOldFav(fav.start),
-          destination: migrateOldFav(fav.destination),
-          via: fav.via.map(migrateOldFav),
-        };
-      }
-    });
-    storage.set('rfavs', savedRoutingFavs);
-  }
+
   return (
     <InnerRoutingFavProvider initialFavs={savedRoutingFavs}>
       {children}

packages/server/render.tsx

@@ -1,6 +1,7 @@
 import { abfahrtenConfigSanitize, commonConfigSanitize } from 'client/util';
 import { ChunkExtractor } from '@loadable/server';
 import { renderToString } from 'react-dom/server';
+import { sanitizeStorage } from 'server/sanitizeStorage';
 import { ServerBaseComponent } from 'client/ServerBaseComponent';
 import { SheetsRegistry } from 'jss';
 import ejs from 'ejs';
@@ -32,6 +33,9 @@ export default (ctx: Context): void => {
   if (selectedDetail) {
     ctx.request.storage.set('selectedDetail', selectedDetail);
   }
+
+  sanitizeStorage(ctx.request.storage);
+
   const routeContext: StaticRouterContext = {};
 
   global.configOverride = {

packages/server/sanitizeStorage.ts

@@ -0,0 +1,78 @@
+import type { MinimalStopPlace } from 'types/stopPlace';
+import type { ServerStorage } from 'client/Common/Storage';
+
+export function sanitizeStorage(storage: ServerStorage): void {
+  sanitizeFavs(storage, 'favs');
+  sanitizeFavs(storage, 'regionalFavs');
+  sanitizeRoutingFavs(storage, 'rfavs');
+}
+
+function sanitizeFavs(
+  storage: ServerStorage,
+  storageKey: 'favs' | 'regionalFavs',
+) {
+  const favs = storage.get(storageKey);
+  if (!favs) {
+    return;
+  }
+  if (typeof favs !== 'object') {
+    storage.remove(storageKey);
+    return;
+  }
+  Object.keys(favs).forEach((favKey) => {
+    // @ts-expect-error migrating old format
+    if (favs[favKey].title || favs[favKey].id) {
+      favs[favKey] = migrateOldFav(favs[favKey]);
+    }
+
+    if (!isCurrentFormatFav(favs[favKey])) {
+      delete favs[favKey];
+    }
+  });
+  storage.set(storageKey, favs);
+}
+
+function isCurrentFormatFav(stop: MinimalStopPlace): boolean {
+  return Boolean(stop.evaNumber && stop.name);
+}
+
+function migrateOldFav(oldFav: any): MinimalStopPlace {
+  return {
+    name: oldFav.title,
+    evaNumber: oldFav.id.length > 7 ? oldFav.id.substring(2) : oldFav.id,
+  };
+}
+
+export function sanitizeRoutingFavs(
+  storage: ServerStorage,
+  storageKey: 'rfavs',
+): void {
+  const favs = storage.get(storageKey);
+  if (!favs) {
+    return;
+  }
+  if (typeof favs !== 'object') {
+    storage.remove(storageKey);
+    return;
+  }
+  Object.keys(favs).forEach((favKey) => {
+    const fav = favs[favKey];
+    // @ts-expect-error migrateOldFormat
+    if (fav.start.id) {
+      fav.start = migrateOldFav(fav.start);
+      fav.destination = migrateOldFav(fav.destination);
+      fav.via = fav.via.map(migrateOldFav);
+      // @ts-expect-error old format hat profile
+      delete fav.profile;
+    }
+
+    if (
+      !isCurrentFormatFav(fav.destination) ||
+      !isCurrentFormatFav(fav.start) ||
+      !fav.via?.every(isCurrentFormatFav)
+    ) {
+      delete favs[favKey];
+    }
+  });
+  storage.set(storageKey, favs);
+}