From 41fafae501faf1b299ba3d88786f820d3925db90 Mon Sep 17 00:00:00 2001
From: Yaro Kasear <git@kasear.net>
Date: Wed, 14 Jan 2026 11:12:38 -0600
Subject: [PATCH] Add further validation to encodeStates.

---
 inventory/static/js/components/draw.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/inventory/static/js/components/draw.js b/inventory/static/js/components/draw.js
index 4c67f2f..f149cdc 100644
--- a/inventory/static/js/components/draw.js
+++ b/inventory/static/js/components/draw.js
@@ -290,11 +290,18 @@ function initGridWidget(root, opts = {}) {
     function encodeStates(shapes) {
         return shapes.map(shape => {
             if (shape.type !== 'stateChange') return shape;
+            const re = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
 
             let newShape = {};
             Object.keys(shape).forEach(key => {
                 if (key === 'strokeOpacity' || key === 'strokeWidth' || key === 'fillOpacity') {
-                    newShape[key] = Math.round(shape[key] * 100);
+                    const v = Number(shape[key]);
+                    if (Number.isFinite(v))
+                        newShape[key] = Math.round(v * 100);
+                } else if (key === 'color') {
+                    newShape[key] = re.test(shape[key]) ? shape[key] : '#000000';
+                } else if (key === 'fill') {
+                    newShape[key] = !!shape[key];
                 }
             });
             return { ...shape, ...newShape };