Technique: Sanitize Difficulty and Skill list

system/scripts/config.js

@@ -16,6 +16,10 @@ L5R5E.xp = {
     techniqueCost: 3,
 };
 
+L5R5E.regex = {
+    techniqueDifficulty: /^@([TS]):([^|]+?)(?:\|(min|max)(?:\(([^)]+?)\))?)?$/,
+};
+
 L5R5E.initiativeSkills = {
     intrigue: "sentiment",
     duel: "meditation",

system/scripts/dice/dice-picker-dialog.js

@@ -686,7 +686,7 @@ export class DicePickerDialog extends FormApplication {
             // 2: "vigilance"
             // 3: "max"
             // 4: "statusRank"
-            const infos = difficulty.match(/^@([TS]):([^|]+?)(?:\|(min|max)(?:\(([^)]+?)\))?)?$/);
+            const infos = difficulty.match(CONFIG.l5r5e.techniqueDifficulty);
             if (!infos) {
                 console.log("L5R5E | Fail to parse difficulty", difficulty);
                 return false;

system/scripts/items/technique-sheet.js

@@ -26,6 +26,72 @@ export class TechniqueSheetL5r5e extends ItemSheetL5r5e {
         }
         sheetData.data.techniquesList = game.l5r5e.HelpersL5r5e.getTechniquesList({ types });
 
+        // Sanitize Difficulty and Skill list
+        sheetData.data.data.skill = TechniqueSheetL5r5e.formatSkillList(sheetData.data.data.skill);
+        sheetData.data.data.difficulty = TechniqueSheetL5r5e.formatDifficulty(sheetData.data.data.difficulty);
+
         return sheetData;
     }
+
+    /**
+     * This method is called upon form submission after form data is validated
+     * @param   {Event}  event    The initial triggering submission event
+     * @param   {Object} formData The object of validated form data with which to update the object
+     * @returns {Promise}         A Promise which resolves once the update operation has completed
+     * @override
+     */
+    async _updateObject(event, formData) {
+        // Sanitize Difficulty and Skill list
+        formData["data.skill"] = TechniqueSheetL5r5e.formatSkillList(formData["data.skill"]);
+        formData["data.difficulty"] = TechniqueSheetL5r5e.formatDifficulty(formData["data.difficulty"]);
+
+        return super._updateObject(event, formData);
+    }
+
+    /**
+     * Sanitize the technique difficulty
+     * @param  {string} str
+     * @return {string}
+     */
+    static formatDifficulty(str) {
+        if (str && !Number.isNumeric(str) && !CONFIG.l5r5e.regex.techniqueDifficulty.test(str)) {
+            return "";
+        }
+        return str;
+    }
+
+    /**
+     * Sanitize the technique skill list
+     * @param  {string} skillList
+     * @return {string}
+     */
+    static formatSkillList(skillList) {
+        if (!skillList) {
+            return "";
+        }
+        const categories = game.l5r5e.HelpersL5r5e.getCategoriesSkillsList();
+
+        // List categories
+        const unqCatList = new Set();
+        skillList.split(",").forEach((s) => {
+            s = s.trim();
+            if (categories.has(s)) {
+                unqCatList.add(s);
+            }
+        });
+
+        // List skill (not include in cat)
+        const unqSkillList = new Set();
+        skillList.split(",").forEach((s) => {
+            s = s.trim();
+            if (CONFIG.l5r5e.skills.has(s)) {
+                const cat = CONFIG.l5r5e.skills.get(s);
+                if (!unqCatList.has(cat)) {
+                    unqSkillList.add(s);
+                }
+            }
+        });
+
+        return [...unqCatList, ...unqSkillList].join(",");
+    }
 }