diff options
author | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
---|---|---|
committer | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
commit | 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c (patch) | |
tree | 3e341c6ebbd1ce9e2bbacd72e7e3793e0bd467c2 /server/middlewares/validators/shared/video-comments.ts | |
parent | 6bcb559fc9a491fc3ce83e7c077ee9dc742b1d63 (diff) | |
download | PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.gz PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.zst PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.zip |
Don't inject untrusted input
Even if it's already checked in middlewares
It's better to have safe modals too
Diffstat (limited to 'server/middlewares/validators/shared/video-comments.ts')
-rw-r--r-- | server/middlewares/validators/shared/video-comments.ts | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/server/middlewares/validators/shared/video-comments.ts b/server/middlewares/validators/shared/video-comments.ts index 8d1a16294..0961b3ec9 100644 --- a/server/middlewares/validators/shared/video-comments.ts +++ b/server/middlewares/validators/shared/video-comments.ts | |||
@@ -1,10 +1,11 @@ | |||
1 | import express from 'express' | 1 | import express from 'express' |
2 | import { VideoCommentModel } from '@server/models/video/video-comment' | 2 | import { VideoCommentModel } from '@server/models/video/video-comment' |
3 | import { MVideoId } from '@server/types/models' | 3 | import { MVideoId } from '@server/types/models' |
4 | import { forceNumber } from '@shared/core-utils' | ||
4 | import { HttpStatusCode, ServerErrorCode } from '@shared/models' | 5 | import { HttpStatusCode, ServerErrorCode } from '@shared/models' |
5 | 6 | ||
6 | async function doesVideoCommentThreadExist (idArg: number | string, video: MVideoId, res: express.Response) { | 7 | async function doesVideoCommentThreadExist (idArg: number | string, video: MVideoId, res: express.Response) { |
7 | const id = parseInt(idArg + '', 10) | 8 | const id = forceNumber(idArg) |
8 | const videoComment = await VideoCommentModel.loadById(id) | 9 | const videoComment = await VideoCommentModel.loadById(id) |
9 | 10 | ||
10 | if (!videoComment) { | 11 | if (!videoComment) { |
@@ -33,7 +34,7 @@ async function doesVideoCommentThreadExist (idArg: number | string, video: MVide | |||
33 | } | 34 | } |
34 | 35 | ||
35 | async function doesVideoCommentExist (idArg: number | string, video: MVideoId, res: express.Response) { | 36 | async function doesVideoCommentExist (idArg: number | string, video: MVideoId, res: express.Response) { |
36 | const id = parseInt(idArg + '', 10) | 37 | const id = forceNumber(idArg) |
37 | const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id) | 38 | const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id) |
38 | 39 | ||
39 | if (!videoComment) { | 40 | if (!videoComment) { |
@@ -57,7 +58,7 @@ async function doesVideoCommentExist (idArg: number | string, video: MVideoId, r | |||
57 | } | 58 | } |
58 | 59 | ||
59 | async function doesCommentIdExist (idArg: number | string, res: express.Response) { | 60 | async function doesCommentIdExist (idArg: number | string, res: express.Response) { |
60 | const id = parseInt(idArg + '', 10) | 61 | const id = forceNumber(idArg) |
61 | const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id) | 62 | const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id) |
62 | 63 | ||
63 | if (!videoComment) { | 64 | if (!videoComment) { |