Skip to content

Sanitize Nightscout token to prevent WebSocket crash on launch #688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marionbarker merged 2 commits into from
Jun 23, 2026
+22 −3
Merged

Sanitize Nightscout token to prevent WebSocket crash on launch #688

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c1c998a
Sanitize Nightscout token to prevent WebSocket crash on launch
bjorkert Jun 22, 2026
97fd3b2
Sanitize URL entry path, not just token, to prevent WebSocket crash
bjorkert Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions LoopFollow/Controllers/Nightscout/NightscoutSocketManager.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,10 @@ class NightscoutSocketManager {
return
}

let url = Storage.shared.url.value
let token = Storage.shared.token.value
// Sanitize defensively: values saved before this fix may still hold a stray
// whitespace/control char that crashes Socket.IO's URL builder on iOS 26.
let url = NightscoutUtils.sanitizeConnectionInput(Storage.shared.url.value)
let token = NightscoutUtils.sanitizeConnectionInput(Storage.shared.token.value)

guard !url.isEmpty else {
disconnect()
Expand Down
11 changes: 11 additions & 0 deletions LoopFollow/Helpers/NightscoutUtils.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,17 @@ class NightscoutUtils {
return request
}

// Strip whitespace/newlines/control characters that can sneak in via paste.
// Neither a URL nor a token may legally contain them, and a stray one breaks
// WebSocket connect (invalid percent-encoded query traps on iOS 26) or makes
// URL parsing fall back to a lossy cleanup that mangles the address.
static func sanitizeConnectionInput(_ input: String) -> String {
input.unicodeScalars
.filter { !CharacterSet.whitespacesAndNewlines.contains($0) && !CharacterSet.controlCharacters.contains($0) }
.map(String.init)
.joined()
}

static func constructURL(baseURL: String, token: String?, endpoint: String, parameters: [String: String]) -> URL? {
var components = URLComponents(string: baseURL)
components?.path = endpoint
Expand Down
8 changes: 7 additions & 1 deletion LoopFollow/Nightscout/NightscoutSettingsViewModel.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ class NightscoutSettingsViewModel: ObservableObject {
@Published var nightscoutToken: String = Storage.shared.token.value {
willSet {
if newValue != nightscoutToken {
Storage.shared.token.value = newValue
Storage.shared.token.value = NightscoutUtils.sanitizeConnectionInput(newValue)
triggerCheckStatus()
}
}
Expand Down Expand Up @@ -93,6 +93,12 @@ class NightscoutSettingsViewModel: ObservableObject {
}

func processURL(_ value: String) {
// Strip whitespace/newlines/control chars first. A URL can't legally contain
// them, and a stray one (e.g. a trailing newline from a paste) otherwise makes
// URLComponents parsing fail and falls through to the lossy fallback below,
// mangling a URL-with-embedded-token into an invalid address.
let value = NightscoutUtils.sanitizeConnectionInput(value)

var useTokenUrl = false

if let urlComponents = URLComponents(string: value), let queryItems = urlComponents.queryItems {
Expand Down
Loading