From 8a11c29cce22ca78a3ad8973fd7fa872eff9c7bb Mon Sep 17 00:00:00 2001
From: Antonella Sgarlatta <anto@standardnotes.com>
Date: Mon, 5 Oct 2026 13:39:43 +0000
Subject: [PATCH] fix: Prevents path injection on subscription tokens endpoints

---
 .../Controller/SubscriptionTokenAuthMiddleware.ts  | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/packages/api-gateway/src/Controller/SubscriptionTokenAuthMiddleware.ts b/packages/api-gateway/src/Controller/SubscriptionTokenAuthMiddleware.ts
index 886d366dc..794f13207 100644
--- a/packages/api-gateway/src/Controller/SubscriptionTokenAuthMiddleware.ts
+++ b/packages/api-gateway/src/Controller/SubscriptionTokenAuthMiddleware.ts
@@ -44,11 +44,19 @@ export class SubscriptionTokenAuthMiddleware extends BaseMiddleware {
     } as SubscriptionResponseLocals
     Object.assign(response.locals, locals)
 
+    if (typeof subscriptionToken !== 'string' || !/^[a-f0-9]+$/i.test(subscriptionToken)) {
+      response.status(401).send({ error: { tag: 'invalid-auth', message: 'Invalid login credentials.' } })
+
+      return
+    }
+
+    const encodedSubscriptionToken = encodeURIComponent(subscriptionToken)
+
     try {
       const url =
         locals.tokenAuthenticationMethod == TokenAuthenticationMethod.OfflineSubscriptionToken
-          ? `${this.authServerUrl}/offline/subscription-tokens/${subscriptionToken}/validate`
-          : `${this.authServerUrl}/subscription-tokens/${subscriptionToken}/validate`
+          ? `${this.authServerUrl}/offline/subscription-tokens/${encodedSubscriptionToken}/validate`
+          : `${this.authServerUrl}/subscription-tokens/${encodedSubscriptionToken}/validate`
 
       const authResponse = await this.httpClient.request({
         method: 'POST',
@@ -86,7 +94,7 @@ export class SubscriptionTokenAuthMiddleware extends BaseMiddleware {
         : (error as Error).message
 
       this.logger.error(
-        `Could not pass the request to ${this.authServerUrl}/subscription-tokens/${subscriptionToken}/validate on underlying service: ${errorMessage}`,
+        `Could not pass the request to ${this.authServerUrl}/subscription-tokens/${encodedSubscriptionToken}/validate on underlying service: ${errorMessage}`,
       )
 
       this.logger.debug('Response error: %O', (error as AxiosError).response ?? error)