1

backend/core/character/adventure.py

@@ -1,4 +1,5 @@
 import base64
+import binascii
 from copy import deepcopy
 
 adv = [
@@ -246,7 +247,12 @@ def get_adv_list():
 
 
 def get_adv_info(value):
-    value = base64.b64decode(value).decode()
+    try:
+        value = base64.b64decode(value, validate=True).decode()
+    except (binascii.Error, TypeError, UnicodeDecodeError):
+        return None
+    if len(value) != 6 or not value.isdigit():
+        return None
     parent_id, child_id, option_id = map(int, (value[:2], value[2:4], value[4:6]))
     parent = next((p for p in adv if p['id'] == parent_id), None)
     if not parent: