fix: add validation guards for status expiration inputs

Author: ricardogarim

apps/meteor/app/api/server/v1/users.ts

@@ -649,7 +649,7 @@ API.v1.addRoute(
 				if (!canViewFullOtherUserInfo) {
 					return API.v1.forbidden();
 				}
-				const escapedEmail = escapeRegExp(this.queryParams.email as string);
+				const escapedEmail = escapeRegExp(this.queryParams.email);
 				nonEmptyQuery['emails.address'] = {
 					$regex: `^${escapedEmail}$`,
 					$options: 'i',
@@ -2002,7 +2002,16 @@ API.v1
 						statusDefault: status,
 						statusSource: 'manual',
 						...(this.bodyParams.message != null && { statusText: this.bodyParams.message }),
-						...(this.bodyParams.expiresAt && { statusExpiresAt: new Date(this.bodyParams.expiresAt) }),
+						...(this.bodyParams.expiresAt &&
+							(() => {
+								const date = new Date(this.bodyParams.expiresAt);
+								if (isNaN(date.getTime())) {
+									throw new Meteor.Error('error-invalid-date', 'Invalid expiresAt date string', {
+										method: 'users.setStatus',
+									});
+								}
+								return { statusExpiresAt: date };
+							})()),
 					});
 				}
 

apps/meteor/client/components/UserStatusText/useExpirationText.ts

@@ -15,7 +15,8 @@ export function parseExpiresAt(value?: unknown): Date | undefined {
 	}
 
 	if (typeof value === 'object' && '$date' in (value as Record<string, unknown>)) {
-		return new Date((value as { $date: number }).$date);
+		const date = new Date((value as { $date: number }).$date);
+		return Number.isNaN(date.getTime()) ? undefined : date;
 	}
 
 	if (typeof value === 'string') {

apps/meteor/client/navbar/NavBarSettingsToolbar/UserMenu/EditStatusModal.tsx

@@ -98,6 +98,7 @@ const EditStatusModal = ({ onClose, userStatus, userStatusText }: EditStatusModa
 	const [duration, setDuration] = useState('');
 	const [customDate, setCustomDate] = useState(() => new Date().toLocaleDateString('en-CA'));
 	const [customTime, setCustomTime] = useState(() => new Date().toTimeString().slice(0, 5));
+	const minCustomDate = useMemo(() => new Date().toLocaleDateString('en-CA'), []);
 
 	const setUserStatus = useEndpoint('POST', '/v1/users.setStatus');
 	const formatTime = useFormatTime();
@@ -123,9 +124,13 @@ const EditStatusModal = ({ onClose, userStatus, userStatusText }: EditStatusModa
 
 	const computeExpiresAt = useCallback((): Date | undefined => {
 		if (duration === 'custom') {
+			if (!customDate || !customTime) {
+				return undefined;
+			}
 			const [year, month, day] = customDate.split('-').map(Number);
 			const [hours, mins] = customTime.split(':').map(Number);
-			return new Date(year, month - 1, day, hours, mins, 0, 0);
+			const parsedDate = new Date(year, month - 1, day, hours, mins, 0, 0);
+			return Number.isNaN(parsedDate.getTime()) ? undefined : parsedDate;
 		}
 
 		const option = DURATION_OPTIONS.find((o) => o.value === duration);
@@ -143,6 +148,10 @@ const EditStatusModal = ({ onClose, userStatus, userStatusText }: EditStatusModa
 	const handleSaveStatus = useCallback(async () => {
 		try {
 			const expiresAt = computeExpiresAt();
+			if (duration === 'custom' && !expiresAt) {
+				dispatchToastMessage({ type: 'error', message: t('Status_choose_date_and_time') });
+				return;
+			}
 			await setUserStatus({
 				message: statusText,
 				status: statusType as UserStatusType,
@@ -155,7 +164,7 @@ const EditStatusModal = ({ onClose, userStatus, userStatusText }: EditStatusModa
 		}
 
 		onClose();
-	}, [onClose, setUserStatus, statusText, statusType, computeExpiresAt, setCustomStatus, dispatchToastMessage, t]);
+	}, [onClose, setUserStatus, statusText, statusType, computeExpiresAt, setCustomStatus, dispatchToastMessage, t, duration]);
 
 	return (
 		<Modal
@@ -234,7 +243,7 @@ const EditStatusModal = ({ onClose, userStatus, userStatusText }: EditStatusModa
 										flexGrow={1}
 										value={customDate}
 										onChange={(e: ChangeEvent<HTMLInputElement>) => setCustomDate(e.currentTarget.value)}
-										min={customDate}
+										min={minCustomDate}
 									/>
 									<InputBox
 										aria-label='Expiration time'

apps/meteor/client/sidebar/RoomList/SidebarItemTemplateWithData.tsx

@@ -168,6 +168,7 @@ const keys: (keyof RoomListRowProps)[] = [
 	't',
 	'sidebarViewMode',
 	'videoConfActions',
+	'userId',
 ];
 
 export default memo(SidebarItemTemplateWithData, (prevProps, nextProps) => {