jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix crash when req.query handling

Browse Source 
https://expressjs.com/en/5x/api.html#req.query

"As req.query’s shape is based on user-controlled input, all properties and values in this object
are untrusted and should be validated before trusting"

In essence, req.query.xx can be an array OR an array of strings.
This commit is contained in:
Girish Ramakrishnan
2025-07-13 13:14:32 +02:00
parent dc7f5e3dbc
commit 04de621e37
14 changed files with 66 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/services.js
+6 -6
View File
@@ -60,13 +60,13 @@ async function configure(req, res, next) {
async function getLogs(req, res, next) {
assert.strictEqual(typeof req.params.service, 'string');
const lines = 'lines' in req.query ? parseInt(req.query.lines, 10) : 10; // we ignore last-event-id
const lines = typeof req.query.lines === 'string' ? parseInt(req.query.lines, 10) : 10; // we ignore last-event-id
if (isNaN(lines)) return next(new HttpError(400, 'lines must be a number'));
const options = {
lines: lines,
follow: false,
format: req.query.format || 'json'
format: typeof req.query.format === 'string' ? req.query.format : 'json'
};
const [error, logStream] = await safe(services.getServiceLogs(req.params.service, options));
@@ -86,7 +86,7 @@ async function getLogs(req, res, next) {
async function getLogStream(req, res, next) {
assert.strictEqual(typeof req.params.service, 'string');
const lines = 'lines' in req.query ? parseInt(req.query.lines, 10) : 10; // we ignore last-event-id
const lines = typeof req.query.lines === 'string' ? parseInt(req.query.lines, 10) : 10; // we ignore last-event-id
if (isNaN(lines)) return next(new HttpError(400, 'lines must be a valid number'));
if (req.headers.accept !== 'text/event-stream') return next(new HttpError(400, 'This API call requires EventStream'));
@@ -139,12 +139,12 @@ async function rebuild(req, res, next) {
async function getMetrics(req, res, next) {
assert.strictEqual(typeof req.params.service, 'string');
if (!req.query.fromSecs || !parseInt(req.query.fromSecs)) return next(new HttpError(400, 'fromSecs must be a number'));
if (!req.query.intervalSecs || !parseInt(req.query.intervalSecs)) return next(new HttpError(400, 'intervalSecs must be a number'));
if (typeof req.query.fromSecs !== 'string' || !parseInt(req.query.fromSecs)) return next(new HttpError(400, 'fromSecs must be a number'));
if (typeof req.query.intervalSecs !== 'string' || !parseInt(req.query.intervalSecs)) return next(new HttpError(400, 'intervalSecs must be a number'));
const fromSecs = parseInt(req.query.fromSecs);
const intervalSecs = parseInt(req.query.intervalSecs);
const noNullPoints = !!req.query.noNullPoints;
const noNullPoints = typeof req.query.noNullPoints === 'string' ? (req.query.noNullPoints === '1' || req.query.noNullPoints === 'true') : false;
const [error, result] = await safe(metrics.get({ fromSecs, intervalSecs, noNullPoints, serviceIds: [req.params.service] }));
if (error) return next(new HttpError(500, error));