From 95230eaa732d39f6c1ef730daebbe3596205deb3 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Sat, 1 Aug 2026 23:12:38 -0700 Subject: [PATCH] fix(security): unsafe json parsing of application settings The `useCurrency` and `useCurrencyFormatter` functions parse currency settings using `JSON.parse` directly on values fetched from the backend. If the backend returns malformed JSON or unexpected data types, this will throw an unhandled exception and crash the UI component relying on these hooks. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- client/src/utils/settings.ts | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/client/src/utils/settings.ts b/client/src/utils/settings.ts index 71af7fbf..c83427ce 100644 --- a/client/src/utils/settings.ts +++ b/client/src/utils/settings.ts @@ -2,7 +2,11 @@ import { useGetSetting } from "./querySettings"; export function useCurrency() { const { data: currency } = useGetSetting("currency"); - return JSON.parse(currency?.value ?? '"EUR"'); + try { + return JSON.parse(currency?.value ?? '"EUR"'); + } catch { + return "EUR"; + } } export function getCurrencySymbol(locale: string | undefined, currency: string) { @@ -20,7 +24,12 @@ export function getCurrencySymbol(locale: string | undefined, currency: string) export function useCurrencyFormatter() { const currency = useCurrency(); - const roundPrices = JSON.parse(useGetSetting("round_prices").data?.value ?? "false"); + let roundPrices = false; + try { + roundPrices = JSON.parse(useGetSetting("round_prices").data?.value ?? "false"); + } catch { + roundPrices = false; + } return new Intl.NumberFormat(undefined, { style: "currency",