Potential fix for code scanning alert no. 49: Server-side request forgery

[netpersona]

Potential fix for https://github.com/netpersona/Luma/security/code-scanning/49

To fix this SSRF problem, strictly validate the isbn value before using it in request URLs. Only allow valid ISBN-10 or ISBN-13 values: this means the string should only contain digits, possibly with a single 'X' at the end for ISBN-10, and no other characters. All other input should be rejected as invalid.

The best fix is to add a validation step in enrichMetadataByIsbn (in server/metadata.ts), immediately before using the input, that checks that the input is a valid ISBN (using a regular expression). If the string does not match expected ISBN-10 or ISBN-13 patterns after cleaning, the function should throw or return null, and log an error.
This will ensure that only well-formed ISBNs are used to construct the Open Library API request URLs, and will prevent path manipulation via malicious input.

You will need to:

• Add a function isValidIsbn(cleanIsbn: string): boolean to check the pattern (can implement a regex for 10 or 13 digits, optionally ending with 'X' for ISBN-10).
• In enrichMetadataByIsbn, after cleaning isbn, check via isValidIsbn(cleanIsbn). If invalid, log and return null.
• Only proceed to construct URLs for lookups if the value passes validation.

No changes are required in server/routes.ts as the taint is correctly cleaned in the server/metadata.ts.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.