Merge pull request #1941 from Jose-Tejera/agent/reject-nonhex-client-paste-ids

Reject non-hexadecimal paste IDs in the client

js/privatebin.js

@@ -1450,7 +1450,7 @@ window.PrivateBin = (function () {
          * @throws {string}
          */
         me.getPasteId = function () {
-            const idRegEx = /^[a-z0-9]{16}$/;
+            const idRegEx = /^[a-f0-9]{16}$/;
 
             // return cached value
             if (id !== null) {

js/test/Model.js

@@ -122,6 +122,14 @@ describe('Model', function () {
                 }
             ));
         });
+        it('throws exception on non-hexadecimal document IDs', () => {
+            const clean = globalThis.cleanup('', {
+                url: 'https://example.com/?gggggggggggggggg#key'
+            });
+            assert.throws(() => PrivateBin.Model.getPasteId());
+            PrivateBin.Model.reset();
+            clean();
+        });
     });
 
     describe('getPasteKey', function () {
@@ -254,4 +262,3 @@ describe('Model', function () {
         });
     });
 });
-