fix: Ensure context icon is valid

Signed-off-by: Enjeck C. <patrathewhiz@gmail.com>

Author: enjeck

lib/Controller/ContextController.php

@@ -102,6 +102,9 @@ public function show(int $contextId): DataResponse {
 	#[NoAdminRequired]
 	public function create(string $name, string $iconName, string $description = '', array $nodes = []): DataResponse {
 		try {
+			if (!$this->isValidIcon($iconName)) {
+				return new DataResponse(['message' => 'Invalid icon name'], Http::STATUS_BAD_REQUEST);
+			}
 			return new DataResponse($this->contextService->create(
 				$name,
 				$iconName,
@@ -139,6 +142,9 @@ public function create(string $name, string $iconName, string $description = '',
 	#[NoAdminRequired]
 	public function update(int $contextId, ?string $name, ?string $iconName, ?string $description, ?array $nodes): DataResponse {
 		try {
+			if ($iconName !== null && !$this->isValidIcon($iconName)) {
+				return new DataResponse(['message' => 'Invalid icon name'], Http::STATUS_BAD_REQUEST);
+			}
 			$nodes = $nodes !== null ? $this->sanitizeInputNodes($nodes) : null;
 			return new DataResponse($this->contextService->update(
 				$contextId,
@@ -271,6 +277,14 @@ public function updateContentOrder(int $contextId, int $pageId, array $content):
 		return new DataResponse($this->contextService->updateContentOrder($pageId, $content));
 	}
 
+	protected function isValidIcon(string $iconName): bool {
+		if ($iconName === '' || !preg_match('/^[a-zA-Z0-9-]+$/', $iconName)) {
+			return false;
+		}
+		$iconPath = dirname(__DIR__, 2) . '/img/material/' . $iconName . '.svg';
+		return file_exists($iconPath);
+	}
+
 	/**
 	 * @param Context[] $contexts
 	 * @return array

src/shared/components/ncIconPicker/mixins/svgHelper.js

@@ -5,11 +5,18 @@
 export default {
 	methods: {
 		async getContextIcon(iconName) {
-			const { default: icon } = await import(
-				`./../../../../../img/material/${iconName}.svg?raw`
-			)
+			try {
+				const { default: icon } = await import(
+					`./../../../../../img/material/${iconName}.svg?raw`
+				)
 
-			return icon.replaceAll(/#fff/g, 'currentColor')
+				return icon.replaceAll(/#fff/g, 'currentColor')
+			} catch (e) {
+				if (iconName !== 'apps') {
+					return this.getContextIcon('apps')
+				}
+				throw e
+			}
 		},
 	},
 }