github-mirror/project-nomad
1
0
Fork 0
mirror of https://github.com/Crosstalk-Solutions/project-nomad.git synced 2026-03-28 03:29:25 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(security): validar chave no endpoint de leitura de settings

Browse Source 
O endpoint GET /api/system/settings aceitava qualquer string como
chave sem validação, enquanto o endpoint de escrita (PATCH) já
validava contra um enum de chaves permitidas.

Adiciona getSettingSchema com a mesma validação vine.enum(SETTINGS_KEYS)
para o endpoint de leitura, rejeitando chaves fora da lista permitida.

Ref #211
This commit is contained in:
LuisMIguelFurlanettoSousa 2026-03-24 06:45:59 -03:00
parent efe6af9b24
commit 874daa816d
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
admin/app/controllers/settings_controller.ts
View File

@ -3,10 +3,9 @@ import { BenchmarkService } from '#services/benchmark_service';
import { MapService } from '#services/map_service'; import { MapService } from '#services/map_service';
import { OllamaService } from '#services/ollama_service'; import { OllamaService } from '#services/ollama_service';
import { SystemService } from '#services/system_service'; import { SystemService } from '#services/system_service';
import { updateSettingSchema } from '#validators/settings'; import { getSettingSchema, updateSettingSchema } from '#validators/settings';
import { inject } from '@adonisjs/core'; import { inject } from '@adonisjs/core';
import type { HttpContext } from '@adonisjs/core/http' import type { HttpContext } from '@adonisjs/core/http'
import type { KVStoreKey } from '../../types/kv_store.js';
@inject() @inject()
export default class SettingsController { export default class SettingsController {
@ -103,8 +102,8 @@ export default class SettingsController {
} }
async getSetting({ request, response }: HttpContext) { async getSetting({ request, response }: HttpContext) {
const key = request.qs().key; const { key } = await getSettingSchema.validate({ key: request.qs().key });
const value = await KVStore.getValue(key as KVStoreKey); const value = await KVStore.getValue(key);
return response.status(200).send({ key, value }); return response.status(200).send({ key, value });
} }

3
admin/app/validators/settings.ts
View File

@ -1,6 +1,9 @@
import vine from "@vinejs/vine"; import vine from "@vinejs/vine";
import { SETTINGS_KEYS } from "../../constants/kv_store.js"; import { SETTINGS_KEYS } from "../../constants/kv_store.js";
export const getSettingSchema = vine.compile(vine.object({
key: vine.enum(SETTINGS_KEYS),
}))
export const updateSettingSchema = vine.compile(vine.object({ export const updateSettingSchema = vine.compile(vine.object({
key: vine.enum(SETTINGS_KEYS), key: vine.enum(SETTINGS_KEYS),