109
109
< h1 > Lab Exercise input1</ h1 >
110
110
< p >
111
111
This is a lab exercise on developing secure software.
112
- For more information, see the < a href ="introduction.html "> introduction to
112
+ For more information, see the < a href ="introduction.html " target =" _blank " > introduction to
113
113
the labs</ a > .
114
114
115
115
< p >
116
- < h2 > Task </ h2 >
116
+ < h2 > Goal </ h2 >
117
117
< p >
118
- < b > Please change the code below so the query parameter
119
- < tt > id</ tt > < i > must</ i > be an integer between 1 and 9999 (including
120
- those numbers).</ b >
118
+ Practice validating input of a simple data type.
121
119
122
120
< p >
123
121
< h2 > Background</ h2 >
@@ -130,18 +128,14 @@ <h2>Background</h2>
130
128
131
129
< p >
132
130
<!-- https://expressjs.com/en/guide/routing.html -->
133
- Express allows us to state that when the system receives
134
- an HTTP < tt > get</ tt > request for a given route
135
- (e.g., < tt > /invoices</ tt > ), Express will run a list of functions ("handlers").
131
+ Express allows us to state that when the system receives a specific request,
132
+ it will run a list of functions ("handlers").
136
133
The library < tt > express-validator</ tt > provides a set of validation functions
137
134
to make it easy to add validation checks.
138
135
139
136
< p >
140
137
The code below sets up handlers for a < tt > get</ tt > request on path
141
138
< tt > /invoices</ tt > .
142
- This code could be triggered, for example, by requesting
143
- < tt > http://localhost:3000/invoices?id=1</ tt >
144
- (if it was running at < tt > localhost</ tt > and responding to port 3000).
145
139
If there are no validation errors, the code is supposed to show the invoice id.
146
140
If there is a validation error, it responds with HTTP
147
141
error code 422 ("Unprocessable Content"), a status code suggesting
@@ -164,25 +158,25 @@ <h2>Background</h2>
164
158
< p >
165
159
< h2 > Task Information</ h2 >
166
160
< p >
167
-
168
- < p >
169
- To complete this task,
170
- after the first parameter to < tt > app.get</ tt >
161
+ To complete this task:
162
+ < ol >
163
+ < li > After the first parameter to < tt > app.get</ tt >
171
164
which says < tt > '/invoices'</ tt > ,
172
165
add a new comma-separated parameter.
173
- Start this new parameter with
166
+ < li > Start this new parameter with
174
167
< tt > query('id')</ tt > to select the
175
168
< tt > id</ tt > parameter for validation (we've filled in this part
176
169
to help get you started).
177
- After < tt > query('id')</ tt > (and before the terminating comma),
170
+ < li > After < tt > query('id')</ tt > (and before the terminating comma),
178
171
add a period (< tt > .</ tt > ) and the validation requirement
179
172
< tt > isInt()</ tt > (< tt > isInt</ tt > validates that the named parameter is
180
173
an integer).
181
- The < tt > isInt</ tt > method takes, as an optional parameter inside
174
+ < li > The < tt > isInt</ tt > method takes, as an optional parameter inside
182
175
its parentheses,
183
176
an object providing a minimum and maximum, e.g.,
184
177
< tt > isInt({min: YOUR_MINIMUM, max: YOUR_MAXIMUM})</ tt > .
185
178
Set < tt > min</ tt > and < tt > max</ tt > to specify the allowed range.
179
+ </ ol >
186
180
187
181
< p >
188
182
Note: JavaScript names are case-sensitive, so < tt > isint</ tt > won't work.
@@ -197,6 +191,10 @@ <h2>Task Information</h2>
197
191
< p >
198
192
< h2 > Interactive Lab (< span id ="grade "> </ span > )</ h2 >
199
193
< p >
194
+ < b > The code below accepts the query parameter < tt > id</ tt > as input.
195
+ Please change it so < tt > id</ tt > is only accepted if it is
196
+ an integer between 1 and 9999 (including those numbers).</ b >
197
+ < p >
200
198
<!--
201
199
You can use this an example for new labs.
202
200
For multi-line inputs, instead of <input id="attempt0" type="text" ...>, use
0 commit comments