snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/shared/disableCustomScripts.ts

@@ -0,0 +1,14 @@
+import { License } from '@rocket.chat/license';
+
+export const disableCustomScripts = () => {
+	const license = License.getLicense();
+
+	if (!license) {
+		return false;
+	}
+
+	const isCustomScriptDisabled = process.env.DISABLE_CUSTOM_SCRIPTS === 'true';
+	const isTrialLicense = license?.information.trial;
+
+	return isCustomScriptDisabled && isTrialLicense;
+};

apps/meteor/server/lib/shared/getModifiedHttpHeaders.ts

@@ -0,0 +1,28 @@
+export const normalizeHeaders = (httpHeaders?: Headers | Record<string, string>) => {
+	if (httpHeaders instanceof Headers) {
+		return { ...Object.fromEntries(httpHeaders.entries()) };
+	}
+
+	return { ...httpHeaders };
+};
+
+export const getModifiedHttpHeaders = (httpHeaders: Headers | Record<string, string>) => {
+	const modifiedHttpHeaders = normalizeHeaders(httpHeaders);
+
+	if ('x-auth-token' in modifiedHttpHeaders) {
+		modifiedHttpHeaders['x-auth-token'] = '[redacted]';
+	}
+
+	if (modifiedHttpHeaders.cookie) {
+		const cookies = modifiedHttpHeaders.cookie.split('; ');
+		const modifiedCookies = cookies.map((cookie: string) => {
+			if (cookie.startsWith('rc_token=')) {
+				return 'rc_token=[redacted]';
+			}
+			return cookie;
+		});
+		modifiedHttpHeaders.cookie = modifiedCookies.join('; ');
+	}
+
+	return modifiedHttpHeaders;
+};

apps/meteor/server/lib/shared/validateName.ts

@@ -0,0 +1,14 @@
+import { settings } from '../../settings';
+
+export const validateName = function (name: string): boolean {
+	const blockedNames = settings.get('Accounts_SystemBlockedUsernameList');
+	if (!blockedNames || typeof blockedNames !== 'string') {
+		return true;
+	}
+
+	if (blockedNames.split(',').includes(name.toLowerCase())) {
+		return false;
+	}
+
+	return true;
+};

apps/meteor/server/lib/shared/validateNameChars.ts

@@ -0,0 +1,21 @@
+export const validateNameChars = (name: string | undefined): boolean => {
+	if (typeof name !== 'string') {
+		return false;
+	}
+
+	const invalidChars = /[<>\\/]/;
+	if (invalidChars.test(name)) {
+		return false;
+	}
+
+	try {
+		const decodedName = decodeURI(name);
+		if (invalidChars.test(decodedName)) {
+			return false;
+		}
+	} catch (err) {
+		return false;
+	}
+
+	return true;
+};