Don't inject untrusted input

[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / shared / video-comments.ts

diff --git a/server/middlewares/validators/shared/video-comments.ts b/server/middlewares/validators/shared/video-comments.ts
index 60132fb6e0bc45869452a6376f5efc1ec11d60b1..0961b3ec9d49ca7fcc88f42147eb589fc2d40f7f 100644 (file)
--- a/server/middlewares/validators/shared/video-comments.ts
+++ b/server/middlewares/validators/shared/video-comments.ts
@@ -1,10 +1,11 @@
-import * as express from 'express'
+import express from 'express'
 import { VideoCommentModel } from '@server/models/video/video-comment'
 import { MVideoId } from '@server/types/models'
-import { HttpStatusCode } from '@shared/models'
+import { forceNumber } from '@shared/core-utils'
+import { HttpStatusCode, ServerErrorCode } from '@shared/models'
 
 async function doesVideoCommentThreadExist (idArg: number | string, video: MVideoId, res: express.Response) {
-  const id = parseInt(idArg + '', 10)
+  const id = forceNumber(idArg)
   const videoComment = await VideoCommentModel.loadById(id)
 
   if (!videoComment) {
@@ -16,7 +17,10 @@ async function doesVideoCommentThreadExist (idArg: number | string, video: MVide
   }
 
   if (videoComment.videoId !== video.id) {
-    res.fail({ message: 'Video comment is not associated to this video.' })
+    res.fail({
+      type: ServerErrorCode.COMMENT_NOT_ASSOCIATED_TO_VIDEO,
+      message: 'Video comment is not associated to this video.'
+    })
     return false
   }
 
@@ -30,7 +34,7 @@ async function doesVideoCommentThreadExist (idArg: number | string, video: MVide
 }
 
 async function doesVideoCommentExist (idArg: number | string, video: MVideoId, res: express.Response) {
-  const id = parseInt(idArg + '', 10)
+  const id = forceNumber(idArg)
   const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id)
 
   if (!videoComment) {
@@ -42,7 +46,10 @@ async function doesVideoCommentExist (idArg: number | string, video: MVideoId, r
   }
 
   if (videoComment.videoId !== video.id) {
-    res.fail({ message: 'Video comment is not associated to this video.' })
+    res.fail({
+      type: ServerErrorCode.COMMENT_NOT_ASSOCIATED_TO_VIDEO,
+      message: 'Video comment is not associated to this video.'
+    })
     return false
   }
 
@@ -51,7 +58,7 @@ async function doesVideoCommentExist (idArg: number | string, video: MVideoId, r
 }
 
 async function doesCommentIdExist (idArg: number | string, res: express.Response) {
-  const id = parseInt(idArg + '', 10)
+  const id = forceNumber(idArg)
   const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id)
 
   if (!videoComment) {