From b5e8ed81b9706e4f63438cdb1e895c0f68ee8f7c Mon Sep 17 00:00:00 2001 From: Shane Kilkelly Date: Thu, 24 May 2018 11:30:03 +0100 Subject: [PATCH] Better sanitization and validation for project-linked-file --- .../Features/LinkedFiles/ProjectFileAgent.coffee | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/services/web/app/coffee/Features/LinkedFiles/ProjectFileAgent.coffee b/services/web/app/coffee/Features/LinkedFiles/ProjectFileAgent.coffee index 55f20ed9a7..75aadf76fc 100644 --- a/services/web/app/coffee/Features/LinkedFiles/ProjectFileAgent.coffee +++ b/services/web/app/coffee/Features/LinkedFiles/ProjectFileAgent.coffee @@ -43,13 +43,18 @@ SourceFileNotFoundError.prototype.__proto__ = Error.prototype module.exports = ProjectFileAgent = sanitizeData: (data) -> - return data + return _.pick( + data, + 'source_project_id', + 'source_entity_path', + 'source_project_display_name' + ) _validate: (data) -> return ( - !!data.source_project_id && - !!data.source_entity_path && - !!data.source_project_display_name + data.source_project_id? && + data.source_entity_path? && + data.source_project_display_name? ) checkAuth: (project_id, data, current_user_id, callback = (error, allowed)->) ->