nelle/jormungandr-bite
1
0
Fork 0
mirror of https://iceshrimp.dev/limepotato/jormungandr-bite.git synced 2025-03-04 07:18:50 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: 🔒 improve tag search security

Browse source
This commit is contained in:
ThatOneCalculator 2023-02-04 12:38:46 -08:00
parent 06ee523871
commit 4073b746b4
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
View file

@ -93,7 +93,7 @@ export default define(meta, paramDef, async (ps, me) => {
try {
if (ps.tag) {
if (!safeForSql(ps.tag)) throw new Error("Injection");
if (!safeForSql(normalizeForSearch(ps.tag))) throw 'Injection';
query.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`);
} else {
query.andWhere(
@ -102,7 +102,7 @@ export default define(meta, paramDef, async (ps, me) => {
qb.orWhere(
new Brackets((qb) => {
for (const tag of tags) {
if (!safeForSql(tag)) throw new Error("Injection");
if (!safeForSql(normalizeForSearch(ps.tag))) throw 'Injection';
qb.andWhere(`'{"${normalizeForSearch(tag)}"}' <@ note.tags`);
}
}),