From e72dbb762144b3f9c40ccd186daa33d413f24c39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maxi=20Quo=C3=9F?= <maxi@quoss.org>
Date: Fri, 7 Feb 2025 01:32:17 +0100
Subject: [PATCH] fix: invalid cron will crash the homepage, close #975

---
 frontend/src/lib/components/DeviceCard.svelte | 17 +++++++++++++----
 frontend/src/lib/components/DeviceForm.svelte |  3 +++
 frontend/src/lib/types/device.ts              |  4 ++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/components/DeviceCard.svelte b/frontend/src/lib/components/DeviceCard.svelte
index df2b100d..22d1a10e 100644
--- a/frontend/src/lib/components/DeviceCard.svelte
+++ b/frontend/src/lib/components/DeviceCard.svelte
@@ -3,6 +3,7 @@
 	import LL, { locale } from '$lib/i18n/i18n-svelte';
 	import { backendUrl, permission, pocketbase } from '$lib/stores/pocketbase';
 	import type { Device } from '$lib/types/device';
+	import { cronRegex } from '$lib/types/device';
 	import {
 		faBed,
 		faCircleArrowDown,
@@ -141,10 +142,18 @@
 	}
 
 	function getNextCronRelativeTime(expression: string, now: number) {
-		const cron = cronParser.parseExpression(expression);
-		return formatRelative(cron.next().toISOString(), now, {
-			locale: dateFnsLocale
-		});
+		if (!cronRegex.test(expression)) {
+			return 'Invalid cron';
+		}
+
+		try {
+			const cron = cronParser.parseExpression(expression);
+			return formatRelative(cron.next().toISOString(), now, {
+				locale: dateFnsLocale
+			});
+		} catch {
+			return 'Invalid cron';
+		}
 	}
 </script>
 
diff --git a/frontend/src/lib/components/DeviceForm.svelte b/frontend/src/lib/components/DeviceForm.svelte
index 93e772ea..fa6b6742 100644
--- a/frontend/src/lib/components/DeviceForm.svelte
+++ b/frontend/src/lib/components/DeviceForm.svelte
@@ -4,6 +4,7 @@
 	import LL from '$lib/i18n/i18n-svelte';
 	import { permission, pocketbase } from '$lib/stores/pocketbase';
 	import type { Device, Group, Port } from '$lib/types/device';
+	import { cronRegex } from '$lib/types/device';
 	import { faSave, faTrash, faX } from '@fortawesome/free-solid-svg-icons';
 	import { onMount } from 'svelte';
 	import Fa from 'svelte-fa';
@@ -392,6 +393,7 @@
 						bind:value={device.wake_cron}
 						disabled={!device.wake_cron_enabled}
 						required={device.wake_cron_enabled}
+						pattern={cronRegex.source}
 					/>
 				</div>
 				<div class="flex flex-col">
@@ -584,6 +586,7 @@
 						bind:value={device.shutdown_cron}
 						disabled={!device.shutdown_cron_enabled}
 						required={device.shutdown_cron_enabled}
+						pattern={cronRegex.source}
 					/>
 				</div>
 				<div class="flex flex-col">
diff --git a/frontend/src/lib/types/device.ts b/frontend/src/lib/types/device.ts
index ad556f6e..6fbd27f7 100644
--- a/frontend/src/lib/types/device.ts
+++ b/frontend/src/lib/types/device.ts
@@ -42,3 +42,7 @@ export type Port = RecordModel & {
 export type Group = RecordModel & {
 	name: string;
 };
+
+export const cronRegex = new RegExp(
+	/(@(annually|yearly|monthly|weekly|daily|hourly))|((((\d+,)+\d+|(\d+(\/|-)\d+)|\d+|\*) ?){5,7})/
+);