From a5d351549da4946f8f0d31d2e69959512699c9d5 Mon Sep 17 00:00:00 2001
From: Oleksandr Piskun <oleksandr2088@icloud.com>
Date: Sat, 24 Oct 2026 10:17:41 +0000
Subject: [PATCH] fix(proxy): refuse the ExApp lifecycle endpoints like HaRP

Signed-off-by: Oleksandr Piskun <oleksandr2088@icloud.com>
---
 lib/Controller/ExAppProxyController.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/Controller/ExAppProxyController.php b/lib/Controller/ExAppProxyController.php
index bd653857..207dd730 100644
--- a/lib/Controller/ExAppProxyController.php
+++ b/lib/Controller/ExAppProxyController.php
@@ -243,6 +243,14 @@ private function prepareProxy(
 			);
 			return null;
 		}
+		// As the ExApp may read it: cut at "?" or "#", decoded once, any case, surrounding slashes and newlines.
+		$target = rawurldecode(substr($other, 0, strcspn($other, '?#')));
+		if (in_array(strtolower(trim($target, "/\n")), ['heartbeat', 'init', 'enabled'], true)) {
+			$this->logger->debug(
+				sprintf('Returning status 404 for "%s": only AppAPI calls this ExApp endpoint.', $other)
+			);
+			return null;
+		}
 		$exApp = $this->exAppService->getExApp($appId);
 		if ($exApp === null) {
 			$this->logger->debug(