From 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 15 Nov 2022 14:41:55 +0100 Subject: Don't inject untrusted input Even if it's already checked in middlewares It's better to have safe modals too --- server/models/abuse/abuse-query-builder.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'server/models/abuse/abuse-query-builder.ts') diff --git a/server/models/abuse/abuse-query-builder.ts b/server/models/abuse/abuse-query-builder.ts index cfc924ba4..74f4542e5 100644 --- a/server/models/abuse/abuse-query-builder.ts +++ b/server/models/abuse/abuse-query-builder.ts @@ -1,5 +1,6 @@ import { exists } from '@server/helpers/custom-validators/misc' +import { forceNumber } from '@shared/core-utils' import { AbuseFilter, AbuseState, AbuseVideoIs } from '@shared/models' import { buildBlockedAccountSQL, buildDirectionAndField } from '../utils' @@ -135,12 +136,12 @@ function buildAbuseListQuery (options: BuildAbusesQueryOptions, type: 'count' | } if (exists(options.count)) { - const count = parseInt(options.count + '', 10) + const count = forceNumber(options.count) suffix += `LIMIT ${count} ` } if (exists(options.start)) { - const start = parseInt(options.start + '', 10) + const start = forceNumber(options.start) suffix += `OFFSET ${start} ` } } -- cgit v1.2.3