From 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 15 Nov 2022 14:41:55 +0100 Subject: Don't inject untrusted input Even if it's already checked in middlewares It's better to have safe modals too --- server/controllers/download.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'server/controllers/download.ts') diff --git a/server/controllers/download.ts b/server/controllers/download.ts index d9f34109f..65b9a1d1b 100644 --- a/server/controllers/download.ts +++ b/server/controllers/download.ts @@ -5,7 +5,7 @@ import { VideosTorrentCache } from '@server/lib/files-cache/videos-torrent-cache import { Hooks } from '@server/lib/plugins/hooks' import { VideoPathManager } from '@server/lib/video-path-manager' import { MStreamingPlaylist, MVideo, MVideoFile, MVideoFullLight } from '@server/types/models' -import { addQueryParams } from '@shared/core-utils' +import { addQueryParams, forceNumber } from '@shared/core-utils' import { HttpStatusCode, VideoStorage, VideoStreamingPlaylistType } from '@shared/models' import { STATIC_DOWNLOAD_PATHS } from '../initializers/constants' import { asyncMiddleware, optionalAuthenticate, videosDownloadValidator } from '../middlewares' @@ -132,7 +132,7 @@ async function downloadHLSVideoFile (req: express.Request, res: express.Response } function getVideoFile (req: express.Request, files: MVideoFile[]) { - const resolution = parseInt(req.params.resolution, 10) + const resolution = forceNumber(req.params.resolution) return files.find(f => f.resolution === resolution) } -- cgit v1.2.3