Merge pull request #564 from zachwn/headerEncoding

jellyfin · Sep 27, 2023 · 96f6d02 · 96f6d02
2 parents baad1e1 + bcb0642
commit 96f6d02
Showing 1 changed file with 5 additions and 6 deletions.
diff --git a/src/utils/authentication.ts b/src/utils/authentication.ts
@@ -9,12 +9,11 @@ import type { ClientInfo, DeviceInfo } from '../models';
  * Returns a valid authorization header string.
  */
 export function getAuthorizationHeader(clientInfo: ClientInfo, deviceInfo: DeviceInfo, accessToken = ''): string {
-	// TODO: We should ensure values are properly escaped
 	return [
-		`MediaBrowser Client="${clientInfo.name}"`,
-		`Device="${deviceInfo.name}"`,
-		`DeviceId="${deviceInfo.id}"`,
-		`Version="${clientInfo.version}"`,
-		`Token="${accessToken}"`
+		`MediaBrowser Client="${encodeURIComponent(clientInfo.name)}"`,
+		`Device="${encodeURIComponent(deviceInfo.name)}"`,
+		`DeviceId="${encodeURIComponent(deviceInfo.id)}"`,
+		`Version="${encodeURIComponent(clientInfo.version)}"`,
+		`Token="${encodeURIComponent(accessToken)}"`
 	].join(', ');
 }