github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-25 08:43:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Validate tags parameter of TopicQuery (#19830)

Browse Source 
Recently, we have seen some errors related to invalid tags value being
passed to TopicQuery.
This commit is contained in:
Bianca Nenciu 2023-01-16 19:20:19 +02:00 committed by GitHub
parent c3070288ea
commit 0fea826f42
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/topic_query.rb
View File

@ -15,10 +15,15 @@ class TopicQuery
@validators ||=
begin
int = lambda { |x| Integer === x || (String === x && x.match?(/^-?[0-9]+$/)) }
zero_up_to_max_int = lambda { |x| int.call(x) && x.to_i.between?(0, PG_MAX_INT) }
array_or_string = lambda { |x| Array === x || String === x }
{ max_posts: zero_up_to_max_int, min_posts: zero_up_to_max_int, page: zero_up_to_max_int }
{
max_posts: zero_up_to_max_int,
min_posts: zero_up_to_max_int,
page: zero_up_to_max_int,
tags: array_or_string,
}
end
end

6
spec/requests/list_controller_spec.rb
View File

@ -30,6 +30,9 @@ RSpec.describe ListController do
get "/latest?page=1111111111111111111111111111111111111111"
expect(response.status).to eq(400)
get "/latest?tags[1]=hello"
expect(response.status).to eq(400)
end
it "returns 200 for legit requests" do
@ -59,6 +62,9 @@ RSpec.describe ListController do
get "/latest.json?topic_ids=14583%2C14584"
expect(response.status).to eq(200)
get "/latest?tags[]=hello"
expect(response.status).to eq(200)
end
(Discourse.anonymous_filters - [:categories]).each do |filter|