explicitly reject requests with invalid characters in query as they l…

…ead to server error
graphhopper · Nov 13, 2024 · 5f57655 · 5f57655
1 parent f219570
commit 5f57655
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/src/main/java/com/graphhopper/converter/resources/AbstractConverterResource.java b/src/main/java/com/graphhopper/converter/resources/AbstractConverterResource.java
@@ -49,7 +49,21 @@ void checkInvalidParameter(boolean reverse, String query, String point) {
             if (query == null || query.trim().isEmpty()) {
                 throw new BadRequestException("q cannot be empty");
             }
+            if (isInvalidString(query, "{}[]")) {
+                throw new BadRequestException("q contains invalid characters like {}[]");
+            }
+        }
+    }
+
+    public static boolean isInvalidString(String input, String allowedSpecialChars) {
+        for (int i = 0; i < input.length(); i++) {
+            char c = input.charAt(i);
+            if (Character.isDigit(c))
+                continue;
+            if (!Character.isLetter(c) && allowedSpecialChars.indexOf(c) == -1)
+                return true;
         }
+        return false;
     }
 
     String getLocaleFromParameter(String locale) {