LOW: No validation of AI-suggested icon values — silent failure if AI returns invalid icon name #8

New issue

Closed

opened 2026-05-09 05:11:34 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:11:34 +00:00

Owner

Severity: LOW

Location

tokengenerator.html, lines 300-306:

if (text) {
    const suggestions = JSON.parse(text);
    iconSelect.value = suggestions.icon;
    bgColorInput.value = suggestions.bgColor;
    iconColorInput.value = suggestions.iconColor;
    generatedIconImage = null;
    drawToken();
}

Description

When the "Suggest Details" feature returns an icon name from the Gemini API, the code directly assigns it to iconSelect.value without validating that the value exists in the icons object. If the AI returns an icon name that doesn't match any of the predefined options (e.g., "dragon", "star", "flame"), the icon selection silently falls back to blank/no icon without any feedback to the user.

Similarly, the AI-suggested color hex codes are used directly without validating they are valid 6-character hex colors.

Recommended Fix

Validate the returned icon name exists in icons before assigning it.
If invalid, fall back to 'none' and log a warning.
Validate hex color values using a regex like /^#[0-9A-Fa-f]{6}$/.

Impact

AI "suggestions" may partially fail silently, leaving the user confused about why the icon didn't change.

## Severity: LOW ## Location `tokengenerator.html`, lines 300-306: ```javascript if (text) { const suggestions = JSON.parse(text); iconSelect.value = suggestions.icon; bgColorInput.value = suggestions.bgColor; iconColorInput.value = suggestions.iconColor; generatedIconImage = null; drawToken(); } ``` ## Description When the "Suggest Details" feature returns an icon name from the Gemini API, the code directly assigns it to `iconSelect.value` without validating that the value exists in the `icons` object. If the AI returns an icon name that doesn't match any of the predefined options (e.g., "dragon", "star", "flame"), the icon selection silently falls back to blank/no icon without any feedback to the user. Similarly, the AI-suggested color hex codes are used directly without validating they are valid 6-character hex colors. ### Recommended Fix - Validate the returned icon name exists in `icons` before assigning it. - If invalid, fall back to 'none' and log a warning. - Validate hex color values using a regex like `/^#[0-9A-Fa-f]{6}$/`. ### Impact AI "suggestions" may partially fail silently, leaving the user confused about why the icon didn't change.