Merge pull request #30 from geoCML/fix-param-sanitization

Fix parameter sanitization
geoCML · Nov 28, 2024 · 3bb947a · 3bb947a
2 parents 75429ef + 5d705ed
commit 3bb947a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/index.js b/src/index.js
@@ -27,7 +27,7 @@ app.get("/registry", async (req, res) => {
 })
 
 app.post("/registry", async (req, res) => {
-    const keyVal = await sanitizeString(key(req.body))
+    const keyVal = await key(req.body)
     const urlVal = sanitizeString(url(req.body))
     const titleVal = sanitizeString(checkForBannedWords(req.body, "title"))
     const descriptionVal = sanitizeString(checkForBannedWords(req.body, "description"))

diff --git a/src/utils.js b/src/utils.js
@@ -16,8 +16,9 @@ export function orderBy(body) {
 }
 
 export async function key(body) {
-    const keyVal = body.hasOwnProperty("key") ? body["key"] : ""
+    const keyVal = body.hasOwnProperty("key") ? sanitizeString(body["key"]) : ""
     if ((await db.result(`SELECT * FROM users WHERE key = '${keyVal}'`, null, r => r.rowCount)) === 0) return ""
+    return keyVal
 }
 
 export function searchByTag(body) {