🐐 Several security fixes

backend/routers/cards.py

@@ -9,7 +9,7 @@ from sqlalchemy.orm import Session
 from game.card import _get_specific_card_async
 from core.database import get_db
 from services.database_functions import check_boosters, fill_card_pool, BOOSTER_MAX
-from core.dependencies import get_current_user, limiter
+from core.dependencies import escape_like, get_current_user, limiter, parse_uuid
 from core.models import Card as CardModel
 from core.models import Deck as DeckModel
 from core.models import DeckCard as DeckCardModel
@@ -43,7 +43,7 @@ def get_cards(
   q = db.query(CardModel).filter(CardModel.user_id == user.id)
 
   if search:
-    q = q.filter(CardModel.name.ilike(f"%{search}%"))
+    q = q.filter(CardModel.name.ilike(f"%{escape_like(search)}%", escape="\\"))
   if rarities:
     q = q.filter(CardModel.card_rarity.in_(rarities))
   if types:
@@ -149,7 +149,7 @@ async def open_pack(request: Request, user: UserModel = Depends(get_current_user
 @router.post("/cards/{card_id}/report")
 def report_card(card_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
   card = db.query(CardModel).filter(
-    CardModel.id == uuid.UUID(card_id),
+    CardModel.id == parse_uuid(card_id, "card_id"),
     CardModel.user_id == user.id
   ).first()
   if not card:
@@ -163,7 +163,7 @@ def report_card(card_id: str, user: UserModel = Depends(get_current_user), db: S
 @limiter.limit("5/hour")
 async def refresh_card(request: Request, card_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
   card = db.query(CardModel).filter(
-    CardModel.id == uuid.UUID(card_id),
+    CardModel.id == parse_uuid(card_id, "card_id"),
     CardModel.user_id == user.id
   ).first()
   if not card:
@@ -206,7 +206,7 @@ async def refresh_card(request: Request, card_id: str, user: UserModel = Depends
 @router.post("/cards/{card_id}/favorite")
 def toggle_favorite(card_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
   card = db.query(CardModel).filter(
-    CardModel.id == uuid.UUID(card_id),
+    CardModel.id == parse_uuid(card_id, "card_id"),
     CardModel.user_id == user.id
   ).first()
   if not card:
@@ -219,7 +219,7 @@ def toggle_favorite(card_id: str, user: UserModel = Depends(get_current_user), d
 @router.post("/cards/{card_id}/willing-to-trade")
 def toggle_willing_to_trade(card_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
   card = db.query(CardModel).filter(
-    CardModel.id == uuid.UUID(card_id),
+    CardModel.id == parse_uuid(card_id, "card_id"),
     CardModel.user_id == user.id
   ).first()
   if not card: