Don't inject untrusted input

Even if it's already checked in middlewares
It's better to have safe modals too

4 files changed, 12 insertions, 2 deletions

diff --git a/shared/core-utils/common/index.ts b/shared/core-utils/common/index.ts
index 720977ead..8d63ee1b2 100644
--- a/shared/core-utils/common/index.ts
+++ b/shared/core-utils/common/index.ts
@@ -2,6 +2,7 @@ export * from './array'
 export * from './random'
 export * from './date'
 export * from './env'
+export * from './number'
 export * from './object'
 export * from './path'
 export * from './regexp'
diff --git a/shared/core-utils/common/number.ts b/shared/core-utils/common/number.ts
new file mode 100644
index 000000000..9a96dcf5c
--- /dev/null
+++ b/shared/core-utils/common/number.ts
@@ -0,0 +1,7 @@
+function forceNumber (value: any) {
+  return parseInt(value + '')
+}
+
+export {
+  forceNumber
+}
diff --git a/shared/extra-utils/ffprobe.ts b/shared/extra-utils/ffprobe.ts
index b8e9f4c18..7efc58a0d 100644
--- a/shared/extra-utils/ffprobe.ts
+++ b/shared/extra-utils/ffprobe.ts
@@ -1,4 +1,5 @@
 import { ffprobe, FfprobeData } from 'fluent-ffmpeg'
+import { forceNumber } from '@shared/core-utils'
 import { VideoFileMetadata, VideoResolution } from '@shared/models/videos'
 
 /**
@@ -55,7 +56,7 @@ async function getAudioStream (videoPath: string, existingProbe?: FfprobeData) {
       return {
         absolutePath: data.format.filename,
         audioStream,
-        bitrate: parseInt(audioStream['bit_rate'] + '', 10)
+        bitrate: forceNumber(audioStream['bit_rate'])
       }
     }
   }
diff --git a/shared/server-commands/miscs/sql-command.ts b/shared/server-commands/miscs/sql-command.ts
index b0d9ce56d..f163cc8c9 100644
--- a/shared/server-commands/miscs/sql-command.ts
+++ b/shared/server-commands/miscs/sql-command.ts
@@ -1,4 +1,5 @@
 import { QueryTypes, Sequelize } from 'sequelize'
+import { forceNumber } from '@shared/core-utils'
 import { AbstractCommand } from '../shared'
 
 export class SQLCommand extends AbstractCommand {
@@ -63,7 +64,7 @@ export class SQLCommand extends AbstractCommand {
 
     if (!total) return 0
 
-    return parseInt(total + '', 10)
+    return forceNumber(total)
   }
 
   getActorImage (filename: string) {