github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-23 19:11:14 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Validate tags parameter of TopicQuery (#19830)

Browse Source 
Recently, we have seen some errors related to invalid tags value being
passed to TopicQuery.
This commit is contained in:
Bianca Nenciu
2023-01-16 19:20:19 +02:00
committed by GitHub
parent c3070288ea
commit 0fea826f42
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/topic_query.rb
View File

@ -15,10 +15,15 @@ class TopicQuery
@validators ||= @validators ||=
begin begin
int = lambda { |x| Integer === x || (String === x && x.match?(/^-?[0-9]+$/)) } int = lambda { |x| Integer === x || (String === x && x.match?(/^-?[0-9]+$/)) }
zero_up_to_max_int = lambda { |x| int.call(x) && x.to_i.between?(0, PG_MAX_INT) } zero_up_to_max_int = lambda { |x| int.call(x) && x.to_i.between?(0, PG_MAX_INT) }
array_or_string = lambda { |x| Array === x || String === x }
{ max_posts: zero_up_to_max_int, min_posts: zero_up_to_max_int, page: zero_up_to_max_int } {
max_posts: zero_up_to_max_int,
min_posts: zero_up_to_max_int,
page: zero_up_to_max_int,
tags: array_or_string,
}
end end
end end

6
spec/requests/list_controller_spec.rb
View File

@ -30,6 +30,9 @@ RSpec.describe ListController do
get "/latest?page=1111111111111111111111111111111111111111" get "/latest?page=1111111111111111111111111111111111111111"
expect(response.status).to eq(400) expect(response.status).to eq(400)
get "/latest?tags[1]=hello"
expect(response.status).to eq(400)
end end
it "returns 200 for legit requests" do it "returns 200 for legit requests" do
@ -59,6 +62,9 @@ RSpec.describe ListController do
get "/latest.json?topic_ids=14583%2C14584" get "/latest.json?topic_ids=14583%2C14584"
expect(response.status).to eq(200) expect(response.status).to eq(200)
get "/latest?tags[]=hello"
expect(response.status).to eq(200)
end end
(Discourse.anonymous_filters - [:categories]).each do |filter| (Discourse.anonymous_filters - [:categories]).each do |filter|