From e0d543f962378111d8d3a4aeda1399f54e5bf859 Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Thu, 16 Apr 2026 10:35:13 +0200
Subject: [PATCH] Fix g-flag regex in getValidId and CSS selector injection in
 getIdFromUrl

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/lib/assetsUtils.js | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/lib/assetsUtils.js b/src/lib/assetsUtils.js
index fd97da0b3..03877507b 100644
--- a/src/lib/assetsUtils.js
+++ b/src/lib/assetsUtils.js
@@ -7,7 +7,8 @@ export function getUrlFromId(assetId) {
 }
 
 export function getIdFromUrl(url) {
-  return document.querySelector("a-assets > [src='" + url + "']")?.id;
+  const escaped = url.replace(/'/g, "\\'");
+  return document.querySelector(`a-assets > [src='${escaped}']`)?.id;
 }
 
 export function getFilename(url, converted = false) {
@@ -20,19 +21,23 @@ export function getFilename(url, converted = false) {
 
 export function isValidId(id) {
   // The correct re should include : and . but A-frame seems to fail while accessing them
-  var re = /^[A-Za-z]+[\w-]*$/;
+  var re = /^[A-Za-z_]+[\w-]*$/;
   return re.test(id);
 }
 
 export function getValidId(name) {
-  // info.name.replace(/\.[^/.]+$/, '').replace(/\s+/g, '')
-  return name
-    .split('.')
-    .shift()
-    .replace(/\s/, '-')
-    .replace(/^\d+\s*/, '')
-    .replace(/[\W]/, '')
-    .toLowerCase();
+  return (
+    name
+      .split('.')
+      .shift()
+      // Replace spaces with hyphens
+      .replace(/\s+/g, '-')
+      // Remove characters that are not letters (A–Z, a–z), numbers (0–9), underscore (_), and hyphen (-)
+      .replace(/[^\w-]+/g, '')
+      // Strip leading hyphens and digits
+      .replace(/^[-\d]+/, '')
+      .toLowerCase()
+  );
 }
 
 export function insertNewAsset(type, id, src, onLoadedCallback = undefined) {