fix: bad validation on api check_domain
Massimo Melina committed
Oct 27, 2025 at 21:46 UTC
f290aed74c6653a381655a457ae12093c0e1e014
2 files changed
+7
-4
src/api.net.ts
+1
-1
@@ -17,7 +17,7 @@ const apis: ApiHandlers = {
17
get_public_ips: getPublicIps,
18
19
async check_domain({ domain }) {
20
- apiAssertTypes({ string: domain })
20
+ apiAssertTypes({ string: { domain } })
21
const resolver = new Resolver()
22
const prjInfo = await getProjectInfo()
23
resolver.setServers(prjInfo.dnsServers)
src/misc.ts
+6
-3
@@ -120,10 +120,13 @@ export class AsapStream<T> extends Readable {
120
}
121
122
export function apiAssertTypes(paramsByType: { [type:string]: { [name:string]: any } }) {
123
- for (const [types,params] of Object.entries(paramsByType))
124
- for (const [name,val] of Object.entries(params))
125
- if (! types.split('_').some(type => type === 'array' ? Array.isArray(val) : typeof val === type))
123
+ for (const [types,params] of Object.entries(paramsByType)) {
124
+ if (!_.isPlainObject(params))
125
+ throw "invalid apiAssertTypes call"
126
+ for (const [name, val] of Object.entries(params))
127
+ if (!types.split('_').some(type => type === 'array' ? Array.isArray(val) : typeof val === type))
128
throw new ApiError(HTTP_BAD_REQUEST, 'bad ' + name)
129
+ }
130
}
131
132
export function createStreamLimiter(limit: number) {