From 116dd8bc53fc683f84dfdc6d5f4fbb9d8aa3f794 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Ch=C5=82odnicki?= <rchl2k@gmail.com>
Date: Mon, 18 Nov 2024 20:15:24 +0100
Subject: [PATCH 1/3] fix: escaped table name passed to the API

---
 views/get.ejs                      |  6 +++---
 views/item.ejs                     |  2 +-
 views/meta.ejs                     |  7 ++++---
 views/partials/error-container.ejs |  5 +++++
 views/scan.ejs                     | 12 ++++++------
 views/tables.ejs                   |  2 +-
 6 files changed, 20 insertions(+), 14 deletions(-)
 create mode 100644 views/partials/error-container.ejs

diff --git a/views/get.ejs b/views/get.ejs
index 0284361..814bd4a 100644
--- a/views/get.ejs
+++ b/views/get.ejs
@@ -24,17 +24,17 @@
 
     <ul class='nav nav-tabs'>
       <li class='nav-item'>
-        <a class='nav-link' href='/tables/<%= Table.TableName %>'>
+        <a class='nav-link' href='/tables/<%= encodeURIComponent(Table.TableName) %>'>
           Items
         </a>
       </li>
       <li class="nav-item">
-        <a class="nav-link active" href="/tables/<%= Table.TableName %>/get">
+        <a class="nav-link active" href="/tables/<%= encodeURIComponent(Table.TableName) %>/get">
           Get
         </a>
       </li>
       <li class='nav-item'>
-        <a class='nav-link' href='/tables/<%= Table.TableName %>/meta'>Meta</a>
+        <a class='nav-link' href='/tables/<%= encodeURIComponent(Table.TableName) %>/meta'>Meta</a>
       </li>
     </ul>
   </header>
diff --git a/views/item.ejs b/views/item.ejs
index 01ba2c5..f17faf2 100644
--- a/views/item.ejs
+++ b/views/item.ejs
@@ -92,7 +92,7 @@
           method: 'delete'
         }).then((response) => {
           if (response.ok) {
-            window.location = `/tables/<%= TableName %>`
+            window.location = `/tables/<%= encodeURIComponent(TableName) %>`
           }
         }).catch((error) => {
           console.error(error)
diff --git a/views/meta.ejs b/views/meta.ejs
index 88257af..31c65d1 100644
--- a/views/meta.ejs
+++ b/views/meta.ejs
@@ -25,17 +25,17 @@
 
     <ul class='nav nav-tabs'>
       <li class='nav-item'>
-        <a class='nav-link' href='/tables/<%= Table.TableName %>'>
+        <a class='nav-link' href='/tables/<%= encodeURIComponent(Table.TableName) %>'>
           Items
         </a>
       </li>
       <li class="nav-item">
-        <a class="nav-link" href="/tables/<%= Table.TableName %>/get">
+        <a class="nav-link" href="/tables/<%= encodeURIComponent(Table.TableName) %>/get">
           Get
         </a>
       </li>
       <li class='nav-item'>
-        <a class='nav-link active' href='/tables/<%= Table.TableName %>/meta'>Meta</a>
+        <a class='nav-link active' href='/tables/<%= encodeURIComponent(Table.TableName) %>/meta'>Meta</a>
       </li>
     </ul>
   </header>
@@ -54,6 +54,7 @@
   <script>
       document.querySelector('#deleteTable').addEventListener('click', () => {
           fetch('/tables/<%= Table.TableName %>', {
+          fetch('/tables/<%= encodeURIComponent(Table.TableName) %>', {
               method: 'delete'
           }).then((response) => {
               if (!response.ok) {
diff --git a/views/partials/error-container.ejs b/views/partials/error-container.ejs
new file mode 100644
index 0000000..63afe8d
--- /dev/null
+++ b/views/partials/error-container.ejs
@@ -0,0 +1,5 @@
+<div class="row">
+    <div class="col">
+        <div id="error-wrapper"></div>
+    </div>
+</div>
diff --git a/views/scan.ejs b/views/scan.ejs
index 87ef7b6..6d00f47 100644
--- a/views/scan.ejs
+++ b/views/scan.ejs
@@ -89,20 +89,20 @@
 
     <ul class="nav nav-tabs">
       <li class="nav-item">
-        <a class="nav-link active item-count" href="/tables/<%= Table.TableName %>">
+        <a class="nav-link active item-count" href="/tables/<%= encodeURIComponent(Table.TableName) %>">
           Items
         </a>
       </li>
       <li class="nav-item">
-        <a class="nav-link" href="/tables/<%= Table.TableName %>/get">
+        <a class="nav-link" href="/tables/<%= encodeURIComponent(Table.TableName) %>/get">
           Get
         </a>
       </li>
       <li class="nav-item">
-        <a class="nav-link" href="/tables/<%= Table.TableName %>/meta">Meta</a>
+        <a class="nav-link" href="/tables/<%= encodeURIComponent(Table.TableName) %>/meta">Meta</a>
       </li>
       <li class="nav-item ml-auto">
-        <a href="/tables/<%= Table.TableName %>/add-item" class="nav-link">Create item</a>
+        <a href="/tables/<%= encodeURIComponent(Table.TableName) %>/add-item" class="nav-link">Create item</a>
       </li>
     </ul>
   </header>
@@ -110,7 +110,7 @@
   <main>
     <form
       autocomplete="off"
-      action="/tables/<%= Table.TableName %>"
+      action="/tables/<%= encodeURIComponent(Table.TableName) %>"
       method="get"
       style="padding-top: 20px;padding-bottom: 20px;"
       id="form"
@@ -405,7 +405,7 @@
 
       if (data.Items.length) {
         $('#items-container').append(data.Items.map(item => {
-          const viewUrl = '/tables/<%= Table.TableName %>/items/' + encodeURIComponent(Object.values(item.__key).join(','))
+          const viewUrl = '/tables/<%= encodeURIComponent(Table.TableName) %>/items/' + encodeURIComponent(Object.values(item.__key).join(','))
           const rowEl = $('<tr><td><a href="' + viewUrl + '">View</a></td></tr>')
 
           for (const column of data.uniqueKeys) {
diff --git a/views/tables.ejs b/views/tables.ejs
index d748ef3..718ff58 100644
--- a/views/tables.ejs
+++ b/views/tables.ejs
@@ -124,7 +124,7 @@
     <ul class="list-group" id="table-list">
       <% for(var i = 0; i < data.length; i++) { %>
         <li class="list-group-item" data-table-name="<%= data[i].TableName %>">
-          <a href='/tables/<%= data[i].TableName %>'>
+          <a href='/tables/<%= encodeURIComponent(data[i].TableName) %>'>
             <%= data[i].TableName %>
           </a>
           <a href="#" onClick="deleteTable('<%= data[i].TableName %>'); return false"

From 2441118726d5fc364d7e78ebbb03f504a7a3a9b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Ch=C5=82odnicki?= <rchl2k@gmail.com>
Date: Mon, 18 Nov 2024 20:16:17 +0100
Subject: [PATCH 2/3] fix

---
 views/meta.ejs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/views/meta.ejs b/views/meta.ejs
index 31c65d1..97e7a23 100644
--- a/views/meta.ejs
+++ b/views/meta.ejs
@@ -53,7 +53,6 @@
   </main>
   <script>
       document.querySelector('#deleteTable').addEventListener('click', () => {
-          fetch('/tables/<%= Table.TableName %>', {
           fetch('/tables/<%= encodeURIComponent(Table.TableName) %>', {
               method: 'delete'
           }).then((response) => {

From 3b6efec35c9f52df2ac5387f7f3a0e4546a7630b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Ch=C5=82odnicki?= <rchl2k@gmail.com>
Date: Mon, 18 Nov 2024 20:17:22 +0100
Subject: [PATCH 3/3] for different fix

---
 views/partials/error-container.ejs | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 views/partials/error-container.ejs

diff --git a/views/partials/error-container.ejs b/views/partials/error-container.ejs
deleted file mode 100644
index 63afe8d..0000000
--- a/views/partials/error-container.ejs
+++ /dev/null
@@ -1,5 +0,0 @@
-<div class="row">
-    <div class="col">
-        <div id="error-wrapper"></div>
-    </div>
-</div>