Sanitize api token on hackatime controller

Fixes #288
2026-05-01 10:45:21 +00:00 · 2025-06-08 20:59:14 -04:00
parent e43f23065d
commit 204cf2d188
1 changed files with 4 additions and 0 deletions
--- a/app/controllers/api/hackatime/v1/hackatime_controller.rb
+++ b/app/controllers/api/hackatime/v1/hackatime_controller.rb
@@ -286,6 +286,10 @@ class Api::Hackatime::V1::HackatimeController < ApplicationController
      api_token ||= params[:api_key]
    end
    return render json: { error: "Unauthorized" }, status: :unauthorized unless api_token.present?
+    
+    # Sanitize api_token to handle invalid UTF-8 sequences
+    api_token = api_token.to_s.encode('UTF-8', invalid: :replace, undef: :replace, replace: '')
+    
    valid_key = ApiKey.find_by(token: api_token)
    return render json: { error: "Unauthorized" }, status: :unauthorized unless valid_key.present?