diff --git a/src/stack.ts b/src/stack.ts index 51d6eea..6b5ac07 100644 --- a/src/stack.ts +++ b/src/stack.ts @@ -2391,19 +2391,38 @@ export class Stack { } private sanitizeIQuery(query: IQuery): boolean { + const allowedKeys = { + _content_type_uid: 'string', + uid: 'string', + _version: { + $exists: 'boolean' + }, + locale: 'string' + }; + + const validateObject = (obj: any, schema: any): boolean => { + for (const key in obj) { + if (!schema.hasOwnProperty(key)) { + return false; + } + if (typeof schema[key] === 'object') { + if (!validateObject(obj[key], schema[key])) { + return false; + } + } else if (typeof obj[key] !== schema[key]) { + return false; + } + } + return true; + }; if (!query || typeof query !== 'object' || Array.isArray(query)) { return false; } - if (!query || !Array.isArray(query.$or)) { + if (!query.$or || !Array.isArray(query.$or)) { return false; } for (const item of query.$or) { - if ( - typeof item._content_type_uid !== 'string' || - typeof item.uid !== 'string' || - (item._version && typeof item._version.$exists !== 'boolean') || - (item.locale && typeof item.locale !== 'string') - ) { + if (!validateObject(item, allowedKeys)) { return false; } }