From 51ec2f7dcdc041d7693237a006bac3ccef91fc67 Mon Sep 17 00:00:00 2001
From: Kristaps Fabians Geikins <fabians@speckle.systems>
Date: Mon, 12 Aug 2024 13:22:03 +0300
Subject: [PATCH] fix(objectloader): prevent cache read/write (#2637)

---
 packages/objectloader/src/index.js | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/packages/objectloader/src/index.js b/packages/objectloader/src/index.js
index 2f5d2f867..552720c7a 100644
--- a/packages/objectloader/src/index.js
+++ b/packages/objectloader/src/index.js
@@ -7,7 +7,7 @@ import {
   ObjectLoaderRuntimeError
 } from './errors/index.js'
 import { polyfillReadableStreamForAsyncIterator } from './helpers/stream.js'
-import { chunk } from '#lodash'
+import { chunk, isString } from '#lodash'
 /**
  * Simple client that streams object info from a Speckle Server.
  * TODO: Object construction progress reporting is weird.
@@ -561,9 +561,13 @@ class ObjectLoader {
       // this.logger("Cache check for : ", idsChunk.length, Date.now() - t0)
 
       for (const cachedObj of cachedData) {
-        if (!cachedObj.data)
-          // non-existent objects are retrieved with `undefined` data
+        if (
+          !cachedObj.data ||
+          (isString(cachedObj.data) && cachedObj.data.startsWith('<html'))
+        ) {
+          // non-existent/invalid objects are retrieved with `undefined` data
           continue
+        }
         ret[cachedObj.id] = cachedObj.data
       }
     }
@@ -581,8 +585,12 @@ class ObjectLoader {
         .transaction('objects', 'readwrite')
         .objectStore('objects')
       for (const obj of objects) {
-        const idAndData = obj.split('\t')
-        store.put(idAndData[1], idAndData[0])
+        const [key, value] = obj.split('\t')
+        if (!value || !isString(value) || value.startsWith('<html')) {
+          continue
+        }
+
+        store.put(value, key)
       }
       return this.promisifyIdbRequest(store.transaction)
     } catch (e) {