From ebdffb008818dfe53466f24d2f935599b0894e8c Mon Sep 17 00:00:00 2001
From: boatbomber <zack@boatbomber.com>
Date: Sat, 8 Oct 2022 10:25:42 -0400
Subject: [PATCH] Sanitiza requested APIs

---
 plugin/src/HeadlessAPI.lua | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/plugin/src/HeadlessAPI.lua b/plugin/src/HeadlessAPI.lua
index 6883e163..cde2ad50 100644
--- a/plugin/src/HeadlessAPI.lua
+++ b/plugin/src/HeadlessAPI.lua
@@ -148,8 +148,7 @@ function API.new(app)
 	end
 
 	function Rojo:RequestAccess(apis: {string}): {[string]: boolean}
-		assert(type(apis) == "table", "Rojo:RequestAccess expects an array of API names")
-		assert(#apis > 0, "Rojo:RequestAccess expects an array of API names")
+		assert(type(apis) == "table", "Rojo:RequestAccess expects an array of valid API names")
 
 		if Rojo:_checkRateLimit("RequestAccess") then
 			-- Because this opens a popup, we dont want to let users get spammed by it
@@ -162,8 +161,19 @@ function API.new(app)
 			Rojo._permissions[source] = {}
 		end
 
-		local alreadyAllowed = true
+		-- Sanitize request
+		local sanitizedApis = {}
 		for _, api in apis do
+			if Rojo[api] then
+				table.insert(sanitizedApis, api)
+			else
+				warn(string.format("Rojo.%s is not a valid API", api))
+			end
+		end
+		assert(#sanitizedApis > 0, "Rojo:RequestAccess expects an array of valid API names")
+
+		local alreadyAllowed = true
+		for _, api in sanitizedApis do
 			if not Rojo._permissions[source][api] then
 				alreadyAllowed = false
 				break
@@ -172,13 +182,13 @@ function API.new(app)
 
 		if alreadyAllowed then
 			local response = {}
-			for _, api in apis do
+			for _, api in sanitizedApis do
 				response[api] = true
 			end
 			return response
 		end
 
-		local response = app:requestPermission(source, name, apis, Rojo._permissions[source])
+		local response = app:requestPermission(source, name, sanitizedApis, Rojo._permissions[source])
 
 		for api, granted in response do
 			Log.warn(string.format(