From 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 15 Nov 2022 14:41:55 +0100 Subject: Don't inject untrusted input Even if it's already checked in middlewares It's better to have safe modals too --- server/models/video/sql/video/videos-id-list-query-builder.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'server/models/video/sql') diff --git a/server/models/video/sql/video/videos-id-list-query-builder.ts b/server/models/video/sql/video/videos-id-list-query-builder.ts index 14f903851..7c864bf27 100644 --- a/server/models/video/sql/video/videos-id-list-query-builder.ts +++ b/server/models/video/sql/video/videos-id-list-query-builder.ts @@ -6,6 +6,7 @@ import { buildDirectionAndField, createSafeIn, parseRowCountResult } from '@serv import { MUserAccountId, MUserId } from '@server/types/models' import { VideoInclude, VideoPrivacy, VideoState } from '@shared/models' import { AbstractRunQuery } from '../../../shared/abstract-run-query' +import { forceNumber } from '@shared/core-utils' /** * @@ -689,12 +690,12 @@ export class VideosIdListQueryBuilder extends AbstractRunQuery { } private setLimit (countArg: number) { - const count = parseInt(countArg + '', 10) + const count = forceNumber(countArg) this.limit = `LIMIT ${count}` } private setOffset (startArg: number) { - const start = parseInt(startArg + '', 10) + const start = forceNumber(startArg) this.offset = `OFFSET ${start}` } } -- cgit v1.2.3