// Validation for a user's synced Reader bookmarks and text highlights. The data comes // from the browser, so everything is checked and malformed entries are dropped. const COLOR = /^#[0-9a-fA-F]{3,8}$/; const BOOKMARK_KEY = /^[1-3]?[A-Za-z]{2,3}-\d{1,3}-\d{1,3}$/; // e.g. "JHN-3-16", "1SA-3-5" const BOOK = /^[1-3A-Za-z]{3}$/; const MAX_BOOKMARKS = 5000; const MAX_HIGHLIGHTS = 20000; const int = (v, min, max) => Number.isInteger(v) && v >= min && v <= max; // Returns { bookmarks, highlights } with only well-formed entries, or null when the body is // not an object at all. export function cleanMarks(body) { if (!body || typeof body !== 'object' || Array.isArray(body)) return null; const bookmarks = {}; if (body.bookmarks && typeof body.bookmarks === 'object' && !Array.isArray(body.bookmarks)) { for (const [key, color] of Object.entries(body.bookmarks).slice(0, MAX_BOOKMARKS)) { if (BOOKMARK_KEY.test(key) && typeof color === 'string' && COLOR.test(color)) bookmarks[key] = color; } } const highlights = []; if (Array.isArray(body.highlights)) { const seen = new Set(); for (const h of body.highlights.slice(0, MAX_HIGHLIGHTS)) { if (!h || typeof h !== 'object') continue; if (typeof h.id !== 'string' || h.id.length === 0 || h.id.length > 64 || seen.has(h.id)) continue; if (!BOOK.test(String(h.book)) || !int(h.chapter, 1, 200) || !int(h.verse, 1, 200)) continue; if (!int(h.startOffset, 0, 5000) || !int(h.endOffset, 1, 5000) || h.endOffset <= h.startOffset) continue; if (typeof h.color !== 'string' || !COLOR.test(h.color)) continue; seen.add(h.id); highlights.push({ id: h.id, book: String(h.book).toUpperCase(), chapter: h.chapter, verse: h.verse, startOffset: h.startOffset, endOffset: h.endOffset, color: h.color, }); } } return { bookmarks, highlights }; }