Allow only valid values for theme query string (#2745)

Author: gregberge

.changeset/loud-files-tap.md

@@ -0,0 +1,5 @@
+---
+'gitbook': patch
+---
+
+Allow only good values for theme query parameter. Avoid having a 500 error when we pass an invalid value.

packages/gitbook/src/lib/api.ts

@@ -876,6 +876,18 @@ export async function getSiteData(
     };
 }
 
+/**
+ * Validate that the customization settings passed are valid.
+ */
+export function validateSerializedCustomization(raw: string): boolean {
+    try {
+        rison.decode_object(raw);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
 /**
  * Get the customization settings for a space from the API.
  */

packages/gitbook/src/middleware.ts

@@ -1,10 +1,11 @@
-import { ContentAPITokenPayload, GitBookAPI } from '@gitbook/api';
+import { ContentAPITokenPayload, CustomizationThemeMode, GitBookAPI } from '@gitbook/api';
 import { setTag, setContext } from '@sentry/nextjs';
 import assertNever from 'assert-never';
 import jwt from 'jsonwebtoken';
 import type { ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies';
 import { NextResponse, NextRequest } from 'next/server';
 import hash from 'object-hash';
+import rison from 'rison';
 
 import {
     PublishedContentWithCache,
@@ -17,6 +18,7 @@ import {
     DEFAULT_API_ENDPOINT,
     getPublishedContentSite,
     getSiteData,
+    validateSerializedCustomization,
 } from '@/lib/api';
 import { race } from '@/lib/async';
 import { buildVersion } from '@/lib/build';
@@ -259,12 +261,12 @@ export async function middleware(request: NextRequest) {
     }
 
     const customization = url.searchParams.get('customization');
-    if (customization) {
+    if (customization && validateSerializedCustomization(customization)) {
         headers.set('x-gitbook-customization', customization);
     }
 
     const theme = url.searchParams.get('theme');
-    if (theme) {
+    if (theme === CustomizationThemeMode.Dark || theme === CustomizationThemeMode.Light) {
         headers.set('x-gitbook-theme', theme);
     }