fix(api): escape json body in api calls to prevent injection (#1072)

* fix(api): escape json body in api calls to prevent injection

* fix(api): replace manual JSON string construction with JSON.stringify to prevent injection

- Replaced template literal JSON construction with JSON.stringify() in all API methods
- Fixes vulnerability where user input containing quotes would break JSON structure
- Affected methods: updateMessage, deleteMessage, updateUserUsername, reactToMessage, reportMessage, starMessage, unstarMessage, pinMessage, unpinMessage, updateUserNameThroughSuggestion

Author: deepak0x

packages/api/src/EmbeddedChatApi.ts

@@ -414,7 +414,10 @@ export default class EmbeddedChatApi {
 
       if (suggestedUsername.success) {
         const response2 = await fetch(`${this.host}/api/v1/users.update`, {
-          body: `{"userId": "${userid}", "data": { "username": "${suggestedUsername.result}" }}`,
+          body: JSON.stringify({
+            userId: userid,
+            data: { username: suggestedUsername.result },
+          }),
           headers: {
             "Content-Type": "application/json",
             "X-Auth-Token": authToken,
@@ -439,7 +442,10 @@ export default class EmbeddedChatApi {
       try {
         const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
         const response = await fetch(`${this.host}/api/v1/users.update`, {
-          body: `{"userId": "${userid}", "data": { "username": "${newUserName}" }}`,
+          body: JSON.stringify({
+            userId: userid,
+            data: { username: newUserName },
+          }),
           headers: {
             "Content-Type": "application/json",
             "X-Auth-Token": authToken,
@@ -776,7 +782,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.delete`, {
-        body: `{"roomId": "${this.rid}", "msgId": "${msgId}"}`,
+        body: JSON.stringify({ roomId: this.rid, msgId }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -794,7 +800,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.update`, {
-        body: `{"roomId": "${this.rid}", "msgId": "${msgId}","text" : "${text}" }`,
+        body: JSON.stringify({ roomId: this.rid, msgId, text }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -854,7 +860,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.starMessage`, {
-        body: `{"messageId": "${mid}"}`,
+        body: JSON.stringify({ messageId: mid }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -872,7 +878,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.unStarMessage`, {
-        body: `{"messageId": "${mid}"}`,
+        body: JSON.stringify({ messageId: mid }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -950,7 +956,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.pinMessage`, {
-        body: `{"messageId": "${mid}"}`,
+        body: JSON.stringify({ messageId: mid }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -970,7 +976,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.unPinMessage`, {
-        body: `{"messageId": "${mid}"}`,
+        body: JSON.stringify({ messageId: mid }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -988,7 +994,11 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.react`, {
-        body: `{"messageId": "${messageId}", "emoji": "${emoji}", "shouldReact": ${shouldReact}}`,
+        body: JSON.stringify({
+          messageId,
+          emoji,
+          shouldReact,
+        }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,
@@ -1006,7 +1016,7 @@ export default class EmbeddedChatApi {
     try {
       const { userId, authToken } = (await this.auth.getCurrentUser()) || {};
       const response = await fetch(`${this.host}/api/v1/chat.reportMessage`, {
-        body: `{"messageId": "${messageId}", "description": "${description}"}`,
+        body: JSON.stringify({ messageId, description }),
         headers: {
           "Content-Type": "application/json",
           "X-Auth-Token": authToken,