Don't inject untrusted input

[github/Chocobozzz/PeerTube.git] / server / helpers / custom-validators / users.ts

diff --git a/server/helpers/custom-validators/users.ts b/server/helpers/custom-validators/users.ts
index badf171d24af87647daf3c102408ec7633ef6e8a..9df550fc21227bae8845f665d1039f3164335dd7 100644 (file)
--- a/server/helpers/custom-validators/users.ts
+++ b/server/helpers/custom-validators/users.ts
@@ -1,6 +1,5 @@
-import { values } from 'lodash'
 import validator from 'validator'
-import { UserRole } from '../../../shared'
+import { UserRole } from '@shared/models'
 import { isEmailEnabled } from '../../initializers/config'
 import { CONSTRAINTS_FIELDS, NSFW_POLICY_TYPES } from '../../initializers/constants'
 import { exists, isArray, isBooleanValid } from './misc'
@@ -27,9 +26,9 @@ function isUserVideoQuotaDailyValid (value: string) {
 }
 
 function isUserUsernameValid (value: string) {
-  const max = USERS_CONSTRAINTS_FIELDS.USERNAME.max
-  const min = USERS_CONSTRAINTS_FIELDS.USERNAME.min
-  return exists(value) && validator.matches(value, new RegExp(`^[a-z0-9._]{${min},${max}}$`))
+  return exists(value) &&
+    validator.matches(value, new RegExp(`^[a-z0-9_]+([a-z0-9_.-]+[a-z0-9_]+)?$`)) &&
+    validator.isLength(value, USERS_CONSTRAINTS_FIELDS.USERNAME)
 }
 
 function isUserDisplayNameValid (value: string) {
@@ -44,9 +43,9 @@ function isUserEmailVerifiedValid (value: any) {
   return isBooleanValid(value)
 }
 
-const nsfwPolicies = values(NSFW_POLICY_TYPES)
+const nsfwPolicies = new Set(Object.values(NSFW_POLICY_TYPES))
 function isUserNSFWPolicyValid (value: any) {
-  return exists(value) && nsfwPolicies.includes(value)
+  return exists(value) && nsfwPolicies.has(value)
 }
 
 function isUserP2PEnabledValid (value: any) {
@@ -90,7 +89,7 @@ function isUserBlockedReasonValid (value: any) {
 }
 
 function isUserRoleValid (value: any) {
-  return exists(value) && validator.isInt('' + value) && UserRole[value] !== undefined
+  return exists(value) && validator.isInt('' + value) && [ UserRole.ADMINISTRATOR, UserRole.MODERATOR, UserRole.USER ].includes(value)
 }
 
 // ---------------------------------------------------------------------------