From c4921f385582041bb68f7a2ac57e394cfc3fdafb Mon Sep 17 00:00:00 2001
From: Half-Shot <will@half-shot.uk>
Date: Mon, 21 Jul 2025 12:22:49 +0100
Subject: [PATCH] limit to roomId

---
 src/UrlParams.test.ts |  9 ++++++---
 src/UrlParams.ts      | 16 ++++++++--------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/UrlParams.test.ts b/src/UrlParams.test.ts
index 048bb942..495f7926 100644
--- a/src/UrlParams.test.ts
+++ b/src/UrlParams.test.ts
@@ -82,11 +82,14 @@ describe("UrlParams", () => {
         getRoomIdentifierFromUrl("", `?roomId=${ROOM_ID}`, "").roomId,
       ).toBe(ROOM_ID);
     });
-    it("handles params with unprintable characters", () => {
+    it("(roomId with unprintable characters)", () => {
       const invisibleChar = "\u2066";
       expect(
-        getRoomIdentifierFromUrl("", `?roomId=${ROOM_ID}${invisibleChar}`, "")
-          .roomId,
+        getRoomIdentifierFromUrl(
+          "",
+          `?roomId=${invisibleChar}${ROOM_ID}${invisibleChar}`,
+          "",
+        ).roomId,
       ).toBe(ROOM_ID);
     });
   });
diff --git a/src/UrlParams.ts b/src/UrlParams.ts
index 43698a21..3b55ed2a 100644
--- a/src/UrlParams.ts
+++ b/src/UrlParams.ts
@@ -220,8 +220,6 @@ class ParamParser {
   private queryParams: URLSearchParams;
 
   public constructor(search: string, hash: string) {
-    // Replace any non-printable characters that another client may have inserted.
-    search = search.replaceAll(/^[^ -~]+|[^ -~]+$/g, "");
     this.queryParams = new URLSearchParams(search);
 
     const fragmentQueryStart = hash.indexOf("?");
@@ -260,8 +258,6 @@ export const getUrlParams = (
   search = window.location.search,
   hash = window.location.hash,
 ): UrlParams => {
-  // Replace any non-printable characters that another client may have inserted.
-  search = search.replaceAll(/^[^ -~]+|[^ -~]+$/g, "");
   const parser = new ParamParser(search, hash);
 
   const fontScale = parseFloat(parser.getParam("fontScale") ?? "");
@@ -391,10 +387,14 @@ export function getRoomIdentifierFromUrl(
 
   // Make sure roomId is valid
   let roomId: string | null = parser.getParam("roomId");
-  if (!roomId?.startsWith("!")) {
-    roomId = null;
-  } else if (!roomId.includes("")) {
-    roomId = null;
+  if (roomId !== null) {
+    // Replace any non-printable characters that another client may have inserted.
+    roomId = roomId.replaceAll(/^[^ -~]+|[^ -~]+$/g, "");
+    if (!roomId.startsWith("!")) {
+      roomId = null;
+    } else if (!roomId.includes("")) {
+      roomId = null;
+    }
   }
 
   return {