Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore: REST query and body params validation #25446

Merged
merged 7 commits into from
May 11, 2022
Merged

Chore: REST query and body params validation #25446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
23e95a2
Improve query and body params validation
ggazzo May 9, 2022
09b34dc
fix
ggazzo May 9, 2022
5ebb369
Merge remote-tracking branch 'origin/develop' into chore/endpoints
ggazzo May 10, 2022
d8144e7
fix
ggazzo May 10, 2022
e938504
..
ggazzo May 10, 2022
f9f4a0a
throw new Meteor.Error
ggazzo May 10, 2022
98bccd2
..
ggazzo May 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/meteor/app/api/server/api.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,8 +397,8 @@ export class APIClass extends Restivus {
try {
api.enforceRateLimit(objectForRateLimitMatch, this.request, this.response, this.userId);

if (_options.validateParams && _options.validateParams(this.request.method === 'GET' ? this.queryParams : this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', _options.validateParams.errors?.map((error) => error.message).join('\n '));
if (_options.validateParams && !_options.validateParams(this.request.method === 'GET' ? this.queryParams : this.bodyParams)) {
throw new Meteor.Error('invalid-params', _options.validateParams.errors?.map((error) => error.message).join('\n '));
}
if (shouldVerifyPermissions && (!this.userId || !hasAllPermission(this.userId, _options.permissionsRequired))) {
throw new Meteor.Error('error-unauthorized', 'User does not have the permissions required for this action', {
Expand Down
142 changes: 64 additions & 78 deletions apps/meteor/app/api/server/v1/channels.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,13 +62,12 @@ function findChannelByIdOrName({

API.v1.addRoute(
'channels.addAll',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsAddAllProps,
},
{
post() {
if (!isChannelsAddAllProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsAddAllProps.errors?.map((error: any) => error.message).join('\n '));
}

const { activeUsersOnly, ...params } = this.bodyParams;
const findResult = findChannelByIdOrName({ params, userId: this.userId });

Expand All @@ -83,13 +82,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.archive',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsArchiveProps,
},
{
post() {
if (!isChannelsArchiveProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsArchiveProps.errors?.map((error: any) => error.message).join('\n '));
}

const findResult = findChannelByIdOrName({ params: this.bodyParams });

Meteor.call('archiveRoom', findResult._id);
Expand All @@ -101,13 +99,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.unarchive',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsUnarchiveProps,
},
{
post() {
if (!isChannelsUnarchiveProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsUnarchiveProps.errors?.map((error: any) => error.message).join('\n '));
}

const findResult = findChannelByIdOrName({
params: this.bodyParams,
checkedArchived: false,
Expand All @@ -126,12 +123,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.history',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsHistoryProps,
},
{
get() {
if (!isChannelsHistoryProps(this.queryParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsHistoryProps.errors?.map((error: any) => error.message).join('\n '));
}
const { roomId, unreads, oldest, latest, showThreadMessages, inclusive } = this.queryParams;
const findResult = findChannelByIdOrName({
params: { roomId },
Expand Down Expand Up @@ -162,12 +159,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.roles',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsRolesProps,
},
{
get() {
if (!isChannelsRolesProps(this.queryParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsRolesProps.errors?.map((error: any) => error.message).join('\n '));
}
const findResult = findChannelByIdOrName({ params: this.queryParams });

const roles = Meteor.call('getRoomRoles', findResult._id);
Expand All @@ -181,13 +178,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.join',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsJoinProps,
},
{
post() {
if (!isChannelsJoinProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsJoinProps.errors?.map((error: any) => error.message).join('\n '));
}

const { roomId, joinCode } = this.bodyParams;
const findResult = findChannelByIdOrName({ params: { roomId } });

Expand All @@ -202,12 +198,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.kick',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsKickProps,
},
{
post() {
if (!isChannelsKickProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsKickProps.errors?.map((error: any) => error.message).join('\n '));
}
const { roomId /* userId */ } = this.bodyParams;
const findResult = findChannelByIdOrName({ params: { roomId } });

Expand All @@ -224,13 +220,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.leave',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsLeaveProps,
},
{
post() {
if (!isChannelsLeaveProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsLeaveProps.errors?.map((error: any) => error.message).join('\n '));
}

const { roomId } = this.bodyParams;
const findResult = findChannelByIdOrName({ params: { roomId } });

Expand All @@ -247,12 +242,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.messages',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsMessagesProps,
},
{
get() {
if (!isChannelsMessagesProps(this.queryParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsMessagesProps.errors?.map((error: any) => error.message).join('\n '));
}
const { roomId } = this.queryParams;
const findResult = findChannelByIdOrName({
params: { roomId },
Expand Down Expand Up @@ -296,13 +291,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.open',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsOpenProps,
},
{
post() {
if (!isChannelsOpenProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsOpenProps.errors?.map((error: any) => error.message).join('\n '));
}

const { roomId } = this.bodyParams;

const findResult = findChannelByIdOrName({
Expand All @@ -329,13 +323,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.setReadOnly',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsSetReadOnlyProps,
},
{
post() {
if (!isChannelsSetReadOnlyProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsSetReadOnlyProps.errors?.map((error: any) => error.message).join('\n '));
}

const { roomId } = this.bodyParams;

const findResult = findChannelByIdOrName({ params: { roomId } });
Expand All @@ -355,15 +348,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.setAnnouncement',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsSetAnnouncementProps,
},
{
post() {
if (!isChannelsSetAnnouncementProps(this.bodyParams)) {
throw new Meteor.Error(
'error-invalid-params',
isChannelsSetAnnouncementProps.errors?.map((error: any) => error.message).join('\n '),
);
}
const { roomId, announcement } = this.bodyParams;

const findResult = findChannelByIdOrName({ params: { roomId } });
Expand All @@ -379,15 +369,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.getAllUserMentionsByChannel',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsGetAllUserMentionsByChannelProps,
},
{
get() {
if (!isChannelsGetAllUserMentionsByChannelProps(this.queryParams)) {
throw new Meteor.Error(
'error-invalid-params',
isChannelsGetAllUserMentionsByChannelProps.errors?.map((error: any) => error.message).join('\n '),
);
}
const { roomId } = this.queryParams;
const { offset, count } = this.getPaginationItems();
const { sort } = this.parseJsonQuery();
Expand Down Expand Up @@ -422,12 +409,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.moderators',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsModeratorsProps,
},
{
get() {
if (!isChannelsModeratorsProps(this.queryParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsModeratorsProps.errors?.map((error: any) => error.message).join('\n '));
}
const { roomId } = this.queryParams;

const findResult = findChannelByIdOrName({ params: { roomId } });
Expand All @@ -447,12 +434,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.delete',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsDeleteProps,
},
{
post() {
if (!isChannelsDeleteProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsDeleteProps.errors?.map((error: any) => error.message).join('\n '));
}
const room = findChannelByIdOrName({
params: this.bodyParams,
checkedArchived: false,
Expand All @@ -467,13 +454,12 @@ API.v1.addRoute(

API.v1.addRoute(
'channels.convertToTeam',
{ authRequired: true },
{
authRequired: true,
validateParams: isChannelsConvertToTeamProps,
},
{
async post() {
if (!isChannelsConvertToTeamProps(this.bodyParams)) {
throw new Meteor.Error('error-invalid-params', isChannelsConvertToTeamProps.errors?.map((error: any) => error.message).join('\n '));
}

if (!hasAllPermission(this.userId, ['create-team', 'edit-room'])) {
return API.v1.unauthorized();
}
Expand Down
Loading