github-mirror/project-nomad
1
0
Fork 0
mirror of https://github.com/Crosstalk-Solutions/project-nomad.git synced 2026-04-05 08:16:16 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(security): validate key parameter on settings read endpoint#517

Browse Source 
Co-authored-by: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
This commit is contained in:
Luís Miguel 2026-04-01 18:56:19 -03:00 committed by Jake Turner
parent edc5148c9c
commit d3c26acebf
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
admin/app/controllers/settings_controller.ts
View File

@ -3,7 +3,7 @@ import { BenchmarkService } from '#services/benchmark_service'
import { MapService } from '#services/map_service' import { MapService } from '#services/map_service'
import { OllamaService } from '#services/ollama_service' import { OllamaService } from '#services/ollama_service'
import { SystemService } from '#services/system_service' import { SystemService } from '#services/system_service'
import { updateSettingSchema } from '#validators/settings' import { getSettingSchema, updateSettingSchema } from '#validators/settings'
import { inject } from '@adonisjs/core' import { inject } from '@adonisjs/core'
import type { HttpContext } from '@adonisjs/core/http' import type { HttpContext } from '@adonisjs/core/http'
import type { KVStoreKey } from '../../types/kv_store.js' import type { KVStoreKey } from '../../types/kv_store.js'
@ -110,9 +110,9 @@ export default class SettingsController {
} }
async getSetting({ request, response }: HttpContext) { async getSetting({ request, response }: HttpContext) {
const key = request.qs().key const { key } = await getSettingSchema.validate({ key: request.qs().key });
const value = await KVStore.getValue(key as KVStoreKey) const value = await KVStore.getValue(key);
return response.status(200).send({ key, value }) return response.status(200).send({ key, value });
} }
async updateSetting({ request, response }: HttpContext) { async updateSetting({ request, response }: HttpContext) {

3
admin/app/validators/settings.ts
View File

@ -1,6 +1,9 @@
import vine from "@vinejs/vine"; import vine from "@vinejs/vine";
import { SETTINGS_KEYS } from "../../constants/kv_store.js"; import { SETTINGS_KEYS } from "../../constants/kv_store.js";
export const getSettingSchema = vine.compile(vine.object({
key: vine.enum(SETTINGS_KEYS),
}))
export const updateSettingSchema = vine.compile(vine.object({ export const updateSettingSchema = vine.compile(vine.object({
key: vine.enum(SETTINGS_KEYS), key: vine.enum(SETTINGS_KEYS),