From 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 15 Nov 2022 14:41:55 +0100 Subject: Don't inject untrusted input Even if it's already checked in middlewares It's better to have safe modals too --- server/middlewares/validators/redundancy.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'server/middlewares/validators/redundancy.ts') diff --git a/server/middlewares/validators/redundancy.ts b/server/middlewares/validators/redundancy.ts index 79460f63c..c80f9b728 100644 --- a/server/middlewares/validators/redundancy.ts +++ b/server/middlewares/validators/redundancy.ts @@ -1,6 +1,7 @@ import express from 'express' import { body, param, query } from 'express-validator' import { isVideoRedundancyTarget } from '@server/helpers/custom-validators/video-redundancies' +import { forceNumber } from '@shared/core-utils' import { HttpStatusCode } from '../../../shared/models/http/http-error-codes' import { exists, @@ -171,7 +172,7 @@ const removeVideoRedundancyValidator = [ async (req: express.Request, res: express.Response, next: express.NextFunction) => { if (areValidationErrors(req, res)) return - const redundancy = await VideoRedundancyModel.loadByIdWithVideo(parseInt(req.params.redundancyId, 10)) + const redundancy = await VideoRedundancyModel.loadByIdWithVideo(forceNumber(req.params.redundancyId)) if (!redundancy) { return res.fail({ status: HttpStatusCode.NOT_FOUND_404, -- cgit v1.2.3