@@ -2017,6 +2017,9 @@ export class Stack {
20172017
20182018 private async bindLeftoverAssets ( queries : IQuery , locale : string , pointerList : IShelf [ ] ) {
20192019 // const contents = await readFile(getAssetsPath(locale) + '.json')
2020+ if ( ! this . sanitizeIQuery ( queries ) ) {
2021+ throw new Error ( 'Invalid queries provided' ) ;
2022+ }
20202023 const filteredAssets = await this . db . collection ( getCollectionName ( {
20212024 content_type_uid : this . types . assets ,
20222025 locale,
@@ -2096,6 +2099,9 @@ export class Stack {
20962099 }
20972100
20982101 private async getReferencePath ( query , locale , currentInclude ) {
2102+ if ( ! this . sanityQueryAny ( query ) ) {
2103+ throw new Error ( 'Invalid query provided' ) ;
2104+ }
20992105 const schemas = await this . db . collection ( getCollectionName ( {
21002106 content_type_uid : this . types . content_types ,
21012107 locale,
@@ -2184,6 +2190,9 @@ export class Stack {
21842190
21852191 private async fetchEntries ( query : IQuery , locale : string , paths : string [ ] , include : string [ ] , includeAll :
21862192 boolean = false ) {
2193+ if ( ! this . sanitizeIQuery ( query ) ) {
2194+ throw new Error ( 'Invalid queries provided' ) ;
2195+ }
21872196 const result = await this . db . collection ( getCollectionName ( {
21882197 content_type_uid : 'entries' ,
21892198 locale,
@@ -2376,5 +2385,30 @@ export class Stack {
23762385 paths,
23772386 }
23782387 }
2379- // tslint:disable-next-line: max-file-line-count
2388+
2389+ private sanitizeIQuery ( query : IQuery ) : boolean {
2390+ if ( ! query || typeof query !== 'object' || Array . isArray ( query ) ) {
2391+ return false ;
2392+ }
2393+ if ( ! query || ! Array . isArray ( query . $or ) ) {
2394+ return false ;
2395+ }
2396+ for ( const item of query . $or ) {
2397+ if (
2398+ typeof item . _content_type_uid !== 'string' ||
2399+ typeof item . uid !== 'string' ||
2400+ ( item . _version && typeof item . _version . $exists !== 'boolean' ) ||
2401+ ( item . locale && typeof item . locale !== 'string' )
2402+ ) {
2403+ return false ;
2404+ }
2405+ }
2406+ return true ;
2407+ }
2408+ private sanityQueryAny ( query : any ) : boolean {
2409+ if ( ! query || typeof query !== 'object' || Array . isArray ( query ) ) {
2410+ return false ;
2411+ }
2412+ return true ;
2413+ }
23802414}
0 commit comments