From 6ba74de73650a0a9624332f6359a9ab379d9e1f6 Mon Sep 17 00:00:00 2001
From: ddrayko <189259481+ddrayko@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:07:18 +0000
Subject: [PATCH] fix scanning alert: Server-side request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 routes/servers.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/routes/servers.js b/routes/servers.js
index 49115f5..85dabb4 100644
--- a/routes/servers.js
+++ b/routes/servers.js
@@ -546,6 +546,10 @@ router.post('/power/:identifier', authenticateToken, powerLimiter, async (req, r
     const { signal } = req.body;
     const pteroId = req.user.pteroId;
 
+    if (typeof identifier !== 'string' || !/^[A-Za-z0-9]+$/.test(identifier)) {
+      return res.status(400).json({ error: 'Invalid server identifier' });
+    }
+
     if (!await verifyServerOwnership(pteroId, identifier)) {
       return res.status(403).json({ error: 'You do not own this server' });
     }
@@ -561,7 +565,8 @@ router.post('/power/:identifier', authenticateToken, powerLimiter, async (req, r
     }
 
     const apiKey = users[0].ptero_client_api_key;
-    const pteroRes = await fetch(`${PTERO_URL}/api/client/servers/${identifier}/power`, {
+    const safeIdentifier = encodeURIComponent(identifier);
+    const pteroRes = await fetch(`${PTERO_URL}/api/client/servers/${safeIdentifier}/power`, {
       method: 'POST',
       headers: {
         'Authorization': `Bearer ${apiKey}`,