check the type of userIds array

2020-11-22 21:42:08 -08:00
parent a8928d26d1
commit 195c9bd81f
1 changed files with 1 additions and 0 deletions
--- a/src/routes/groups.js
+++ b/src/routes/groups.js
@@ -62,6 +62,7 @@ function updateMembers(req, res, next) {

    if (!req.body.userIds) return next(new HttpError(404, 'missing or invalid userIds fields'));
    if (!Array.isArray(req.body.userIds)) return next(new HttpError(404, 'userIds must be an array'));
+    if (req.body.userIds.some((u) => typeof u !== 'string')) return next(new HttpError(400, 'userIds array must contain strings'));

    groups.setMembers(req.params.groupId, req.body.userIds, function (error) {
        if (error) return next(BoxError.toHttpError(error));