-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
#2020 - Remediate high risk vulnerabilities from WAVA report (API Mas…
…s Assignment) (#2045) ### Context Enabled the Nestjs configuration `forbidNonWhitelisted` to force the API to throw an error and return a "bad request" if some property not mapped to the DTO is received (more info on [forbidNonWhitelisted](https://docs.nestjs.com/techniques/validation)). Currently, the API already has the configuration `whitelist` which will remove any DTO-non-mapped-property from the payload received. Enabling the `forbidNonWhitelisted` will allow the API to return a better response and also restrict unknown query string parameters. #### PR Goal The PR intention is primarily to enable the API configuration and adjust the HTTP call from the web application to ensure that non-extra properties will be sent. The web application sends extra values when the payload is not "manually created" which happens basically when the form.io submissions objects are sent directly to the API. These payloads contain the properties needed by the API and enforced by the DTO but they also contain some extra non-expected values that were part of the form.io form but do not need to be part of the HTTP request. To enforce the DTO properties, the class-transformer package was used (the same used by Nestjs) to convert a "plain object", like the form.io submission, to a DTO class, also removing any extra property along the process. Not every form.io definition had its output converted to a class because not every form.io form is consumed in the same way. Please see below the ones affected. Typed to a class to exclude extraneous values. - educationprogram - educationprogramoffering - institutionlocation - institutionprofile - institutionprofilecreation - institutionuserprofile - programinformationrequest - uploadstudentdocuments - studentprofile - studentexceptions No changes are needed because the payload is controlled. - confirmsstudentenrollment - designationagreementdetails - reportscholasticstandingchange - uploadstudentdocumentsaest - exportfinancialreports - staffapprovalappeal - studentrequestchange To be removed in an upcoming PR. - approvedeclineoffering - approvedenydesignation - approveeducationprogram - createnote - declineeducationprogram - studentapplicationdetails - trackstudentapplication
- Loading branch information
1 parent
d521713
commit 0ec81a8
Showing
53 changed files
with
635 additions
and
226 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 change: 1 addition & 0 deletions
1
sources/packages/backend/apps/api/src/utilities/class-transform/index.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| export * from "./to-boolean"; |
40 changes: 40 additions & 0 deletions
40
sources/packages/backend/apps/api/src/utilities/class-transform/to-boolean.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| import { Transform } from "class-transformer"; | ||
|
|
||
| /** | ||
| * Converts a plain property to boolean. | ||
| * @returns function that will return the converted boolean value. | ||
| */ | ||
| export const ToBoolean = (): ((target: unknown, key: string) => void) => { | ||
| return (target: unknown, key: string) => { | ||
| return Transform( | ||
| ({ obj }) => { | ||
| return valueToBoolean(obj[key]); | ||
| }, | ||
| { | ||
| toClassOnly: true, | ||
| }, | ||
| )(target, key); | ||
| }; | ||
| }; | ||
|
|
||
| /** | ||
| * Converts an object to boolean value, if not a boolean already. | ||
| * @param value expected value to be converted, if needed. | ||
| * @returns boolean value if object is defined. | ||
| */ | ||
| const valueToBoolean = (value: unknown): boolean | undefined => { | ||
| if (value === null || value === undefined) { | ||
| return undefined; | ||
| } | ||
| if (typeof value === "boolean") { | ||
| return value; | ||
| } | ||
| switch ((value as string).toLowerCase()) { | ||
| case "true": | ||
| return true; | ||
| case "false": | ||
| return false; | ||
| default: | ||
| return undefined; | ||
| } | ||
| }; |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.