Added extra sysinfo validation.
Ylian Saint-Hilaire committed
Feb 28, 2021 at 23:39 UTC
fc7bb97a37a5baee3308007b8832b2b68fe2bf03
2 files changed
+25
common.js
+21
@@ -292,4 +292,25 @@ module.exports.meshServerRightsArrayToNumber = function (val) {
292
return newAccRights;
293
}
294
return null;
295
+}
296
+
297
+
298
+// Validate an object to make sure it can be stored in MongoDB
299
+module.exports.validateObjectForMongo = function (obj, maxStrLen) {
300
+ return validateObjectForMongoRec(obj, maxStrLen);
301
+}
302
+
303
+function validateObjectForMongoRec(obj, maxStrLen) {
304
+ if (typeof obj != 'object') return false;
305
+ for (var i in obj) {
306
+ // Check the key name is not too long
307
+ if (i.length > 100) return false;
308
+ // Check if all chars are alpha-numeric or underscore.
309
+ for (var j in i) { const c = i.charCodeAt(j); if ((c < 48) || ((c > 57) && (c < 65)) || ((c > 90) && (c < 97) && (c != 95)) || (c > 122)) return false; }
310
+ // If the value is a string, check it's not too long
311
+ if ((typeof obj[i] == 'string') && (obj[i].length > maxStrLen)) return false;
312
+ // If the value is an object, check it.
313
+ if ((typeof obj[i] == 'object') && (Array.isArray(obj[i]) == false) && (validateObjectForMongoRec(obj[i], maxStrLen) == false)) return false;
314
+ }
315
+ return true;
316
}
\ No newline at end of file
meshagent.js
+4
@@ -1360,6 +1360,10 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1360
}
1361
case 'sysinfo': {
1362
if ((typeof command.data == 'object') && (typeof command.data.hash == 'string')) {
1363
+ // Validate command.data.
1364
+ if (common.validateObjectForMongo(command.data, 1024) == false) break;
1365
+
1366
+ // Save to database
1367
command.data._id = 'si' + obj.dbNodeKey;
1368
command.data.type = 'sysinfo';
1369
command.data.domain = domain.id;