From 5bbec503ea56eb1c8e1a373f3d98debe2461e2a0 Mon Sep 17 00:00:00 2001
From: Vlyan <vlyan26@gmail.com>
Date: Sat, 12 Feb 2022 13:07:14 +0100
Subject: [PATCH] Technique: Sanitize Difficulty and Skill list

---
 system/scripts/config.js                  |  4 ++
 system/scripts/dice/dice-picker-dialog.js |  2 +-
 system/scripts/items/technique-sheet.js   | 66 +++++++++++++++++++++++
 3 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/system/scripts/config.js b/system/scripts/config.js
index dbe9f2f..a31fc24 100644
--- a/system/scripts/config.js
+++ b/system/scripts/config.js
@@ -16,6 +16,10 @@ L5R5E.xp = {
     techniqueCost: 3,
 };
 
+L5R5E.regex = {
+    techniqueDifficulty: /^@([TS]):([^|]+?)(?:\|(min|max)(?:\(([^)]+?)\))?)?$/,
+};
+
 L5R5E.initiativeSkills = {
     intrigue: "sentiment",
     duel: "meditation",
diff --git a/system/scripts/dice/dice-picker-dialog.js b/system/scripts/dice/dice-picker-dialog.js
index d6b61cf..dd11a84 100644
--- a/system/scripts/dice/dice-picker-dialog.js
+++ b/system/scripts/dice/dice-picker-dialog.js
@@ -686,7 +686,7 @@ export class DicePickerDialog extends FormApplication {
             // 2: "vigilance"
             // 3: "max"
             // 4: "statusRank"
-            const infos = difficulty.match(/^@([TS]):([^|]+?)(?:\|(min|max)(?:\(([^)]+?)\))?)?$/);
+            const infos = difficulty.match(CONFIG.l5r5e.techniqueDifficulty);
             if (!infos) {
                 console.log("L5R5E | Fail to parse difficulty", difficulty);
                 return false;
diff --git a/system/scripts/items/technique-sheet.js b/system/scripts/items/technique-sheet.js
index 9930afe..aa31d2a 100644
--- a/system/scripts/items/technique-sheet.js
+++ b/system/scripts/items/technique-sheet.js
@@ -26,6 +26,72 @@ export class TechniqueSheetL5r5e extends ItemSheetL5r5e {
         }
         sheetData.data.techniquesList = game.l5r5e.HelpersL5r5e.getTechniquesList({ types });
 
+        // Sanitize Difficulty and Skill list
+        sheetData.data.data.skill = TechniqueSheetL5r5e.formatSkillList(sheetData.data.data.skill);
+        sheetData.data.data.difficulty = TechniqueSheetL5r5e.formatDifficulty(sheetData.data.data.difficulty);
+
         return sheetData;
     }
+
+    /**
+     * This method is called upon form submission after form data is validated
+     * @param   {Event}  event    The initial triggering submission event
+     * @param   {Object} formData The object of validated form data with which to update the object
+     * @returns {Promise}         A Promise which resolves once the update operation has completed
+     * @override
+     */
+    async _updateObject(event, formData) {
+        // Sanitize Difficulty and Skill list
+        formData["data.skill"] = TechniqueSheetL5r5e.formatSkillList(formData["data.skill"]);
+        formData["data.difficulty"] = TechniqueSheetL5r5e.formatDifficulty(formData["data.difficulty"]);
+
+        return super._updateObject(event, formData);
+    }
+
+    /**
+     * Sanitize the technique difficulty
+     * @param  {string} str
+     * @return {string}
+     */
+    static formatDifficulty(str) {
+        if (str && !Number.isNumeric(str) && !CONFIG.l5r5e.regex.techniqueDifficulty.test(str)) {
+            return "";
+        }
+        return str;
+    }
+
+    /**
+     * Sanitize the technique skill list
+     * @param  {string} skillList
+     * @return {string}
+     */
+    static formatSkillList(skillList) {
+        if (!skillList) {
+            return "";
+        }
+        const categories = game.l5r5e.HelpersL5r5e.getCategoriesSkillsList();
+
+        // List categories
+        const unqCatList = new Set();
+        skillList.split(",").forEach((s) => {
+            s = s.trim();
+            if (categories.has(s)) {
+                unqCatList.add(s);
+            }
+        });
+
+        // List skill (not include in cat)
+        const unqSkillList = new Set();
+        skillList.split(",").forEach((s) => {
+            s = s.trim();
+            if (CONFIG.l5r5e.skills.has(s)) {
+                const cat = CONFIG.l5r5e.skills.get(s);
+                if (!unqCatList.has(cat)) {
+                    unqSkillList.add(s);
+                }
+            }
+        });
+
+        return [...unqCatList, ...unqSkillList].join(",");
+    }
 }