Skip to content

[SER-1555] Hooks insufficient null checks #5419

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Nov 8, 2024
Merged

[SER-1555] Hooks insufficient null checks #5419

Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
d0fe9ee
hooks insufficient null checks
umtcntp Jul 19, 2024
a3e6b99
hooks insufficient null checks
umtcntp Jul 19, 2024
674a9f2
hooks insufficient null checks test
umtcntp Jul 22, 2024
b7414dd
hooks insufficient null checks test
umtcntp Jul 22, 2024
76d0a56
hooks insufficient null checks test
umtcntp Jul 22, 2024
066d2a5
hooks insufficient null checks test
umtcntp Jul 22, 2024
ccb57c2
nul checks test commit
umtcntp Sep 23, 2024
e798808
nul checks test commit
umtcntp Sep 23, 2024
37ca9e9
Merge branch 'next' into SER-1555-deepscan-hooks-fix-insufficient-nul…
ArtursKadikis Sep 30, 2024
c661d65
Merge branch 'next' into SER-1555-deepscan-hooks-fix-insufficient-nul…
umtcntp Oct 1, 2024
54700ae
deepscan new issues
umtcntp Oct 2, 2024
3f2dba8
deepscan new issues
umtcntp Oct 2, 2024
d9f219c
deepscan new issues
umtcntp Oct 2, 2024
f751821
Merge branch 'next' into SER-1555-deepscan-hooks-fix-insufficient-nul…
ArtursKadikis Oct 2, 2024
5488c0d
Merge branch 'next' into SER-1555-deepscan-hooks-fix-insufficient-nul…
umtcntp Oct 3, 2024
344d992
Merge branch 'next' into SER-1555-deepscan-hooks-fix-insufficient-nul…
cihadtekin Nov 8, 2024
1b12d46
eslint fixes
umtcntp Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 59 additions & 42 deletions plugins/hooks/api/api.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,6 @@ plugins.register("/permissions/features", function(ob) {
plugins.register("/i/hook/save", function(ob) {
let paramsInstance = ob.params;


validateCreate(ob.params, FEATURE_NAME, function(params) {
let hookConfig = params.qstring.hook_config;
if (!hookConfig) {
Expand All @@ -283,50 +282,57 @@ plugins.register("/i/hook/save", function(ob) {
try {
hookConfig = JSON.parse(hookConfig);
hookConfig = sanitizeConfig(hookConfig);
if (!(common.validateArgs(hookConfig, CheckHookProperties(hookConfig)))) {
common.returnMessage(params, 400, 'Not enough args');
return true;
}
if (hookConfig) {
// Null check for hookConfig
if (!(common.validateArgs(hookConfig, CheckHookProperties(hookConfig)))) {
common.returnMessage(params, 400, 'Not enough args');
return true;
}

if (hookConfig.effects && !validateEffects(hookConfig.effects)) {
common.returnMessage(params, 400, 'Invalid configuration for effects');
return true;
}
if (hookConfig.effects && !validateEffects(hookConfig.effects)) {
common.returnMessage(params, 400, 'Invalid configuration for effects');
return true;
}

if (hookConfig._id) {
const id = hookConfig._id;
delete hookConfig._id;
return common.db.collection("hooks").findAndModify(
{ _id: common.db.ObjectID(id) },
{},
{$set: hookConfig},
{new: true},
function(err, result) {
if (!err) {
// Audit log: Hook updated
if (result && result.value) {
plugins.dispatch("/systemlogs", {
params: params,
action: "hook_updated",
data: {
updatedHookID: result.value._id,
updatedBy: params.member._id,
updatedHookName: result.value.name
}
});
if (hookConfig._id) {
const id = hookConfig._id;
delete hookConfig._id;
return common.db.collection("hooks").findAndModify(
{ _id: common.db.ObjectID(id) },
{},
{$set: hookConfig},
{new: true},
function(err, result) {
if (!err) {
// Audit log: Hook updated
if (result && result.value) {
plugins.dispatch("/systemlogs", {
params: params,
action: "hook_updated",
data: {
updatedHookID: result.value._id,
updatedBy: params.member._id,
updatedHookName: result.value.name
}
});
}
else {
common.returnMessage(params, 500, "No result found");
}
common.returnOutput(params, result && result.value);
}
else {
common.returnMessage(params, 500, "No result found");
common.returnMessage(params, 500, "Failed to save an hook");
}
common.returnOutput(params, result && result.value);
}
else {
common.returnMessage(params, 500, "Failed to save an hook");
}
});
);
}

}
if (hookConfig) {
hookConfig.createdBy = params.member._id; // Accessing property now with proper check
hookConfig.created_at = new Date().getTime();
}
hookConfig.createdBy = params.member._id;
hookConfig.created_at = new Date().getTime();
return common.db.collection("hooks").insert(
hookConfig,
function(err, result) {
Expand Down Expand Up @@ -608,43 +614,54 @@ plugins.register("/i/hook/test", function(ob) {
let hookConfig = params.qstring.hook_config;
if (!hookConfig) {
common.returnMessage(params, 400, 'Invalid hookConfig');
return true;
return;
}

try {
hookConfig = JSON.parse(hookConfig);
if (!hookConfig) {
common.returnMessage(params, 400, 'Parsed hookConfig is invalid');
return;
}
hookConfig = sanitizeConfig(hookConfig);
const mockData = JSON.parse(params.qstring.mock_data);

if (!(common.validateArgs(hookConfig, CheckHookProperties(hookConfig)))) {
common.returnMessage(params, 403, "hook config invalid");
return; // Add return to exit early
}

// Null check for effects
if (hookConfig.effects && !validateEffects(hookConfig.effects)) {
common.returnMessage(params, 400, 'Config invalid');
return true;
return; // Add return to exit early
}


// trigger process
log.d(JSON.stringify(hookConfig), "[hook test config]");
const results = [];

// build mock data
const trigger = hookConfig.trigger;
if (!trigger) {
common.returnMessage(params, 400, 'Trigger is missing');
return;
}
hookConfig._id = null;

log.d("[hook test mock data]", mockData);
const obj = {
is_mock: true,
params: mockData,
rule: hookConfig
};

log.d("[hook test config data]", obj);
const t = new Triggers[trigger.type]({
rules: [hookConfig],
});

// out put trigger result
// output trigger result
const triggerResult = await t.process(obj);
log.d("[hook trigger test result]", triggerResult);
results.push(JSON.parse(JSON.stringify(triggerResult)));
Expand Down
Loading