@@ -146,19 +146,72 @@ folly::Expected<uint64_t, moxygen::ErrorCode> decodeDelta(
146146
147147namespace moxygen {
148148
149+ // Frame type sets for parameter allowlist
150+ const folly::F14FastSet<FrameType> kAllowedFramesForAuthToken = {
151+ FrameType::PUBLISH ,
152+ FrameType::SUBSCRIBE ,
153+ FrameType::SUBSCRIBE_UPDATE ,
154+ FrameType::SUBSCRIBE_ANNOUNCES ,
155+ FrameType::ANNOUNCE ,
156+ FrameType::TRACK_STATUS ,
157+ FrameType::FETCH };
158+
159+ const folly::F14FastSet<FrameType> kAllowedFramesForDeliveryTimeout = {
160+ FrameType::PUBLISH_OK ,
161+ FrameType::SUBSCRIBE ,
162+ FrameType::SUBSCRIBE_UPDATE };
163+
164+ const folly::F14FastSet<FrameType> kAllowedFramesForSubscriberPriority = {
165+ FrameType::SUBSCRIBE ,
166+ FrameType::FETCH ,
167+ FrameType::SUBSCRIBE_UPDATE ,
168+ FrameType::PUBLISH_OK };
169+
170+ const folly::F14FastSet<FrameType> kAllowedFramesForSubscriptionFilter = {
171+ FrameType::SUBSCRIBE ,
172+ FrameType::PUBLISH_OK ,
173+ FrameType::SUBSCRIBE_UPDATE };
174+
175+ const folly::F14FastSet<FrameType> kAllowedFramesForExpires = {
176+ FrameType::SUBSCRIBE_OK ,
177+ FrameType::PUBLISH ,
178+ FrameType::PUBLISH_OK ,
179+ FrameType::REQUEST_OK };
180+
181+ const folly::F14FastSet<FrameType> kAllowedFramesForGroupOrder = {
182+ FrameType::SUBSCRIBE ,
183+ FrameType::PUBLISH_OK ,
184+ FrameType::FETCH };
185+
186+ const folly::F14FastSet<FrameType> kAllowedFramesForLargestObject = {
187+ FrameType::SUBSCRIBE_OK ,
188+ FrameType::PUBLISH ,
189+ FrameType::REQUEST_OK };
190+
191+ const folly::F14FastSet<FrameType> kAllowedFramesForForward = {
192+ FrameType::SUBSCRIBE ,
193+ FrameType::SUBSCRIBE_UPDATE ,
194+ FrameType::PUBLISH ,
195+ FrameType::PUBLISH_OK ,
196+ FrameType::SUBSCRIBE_ANNOUNCES };
197+
149198// Allowlist mapping: TrackRequestParamKey -> set of allowed FrameTypes
199+ // Empty set means allowed for all frame types
150200const folly::F14FastMap<TrackRequestParamKey, folly::F14FastSet<FrameType>>
151201 kParamAllowlist = {
152- {TrackRequestParamKey::DELIVERY_TIMEOUT , {}},
153- {TrackRequestParamKey::AUTHORIZATION_TOKEN , {}},
202+ {TrackRequestParamKey::AUTHORIZATION_TOKEN , kAllowedFramesForAuthToken },
203+ {TrackRequestParamKey::DELIVERY_TIMEOUT ,
204+ kAllowedFramesForDeliveryTimeout },
154205 {TrackRequestParamKey::MAX_CACHE_DURATION , {}},
155206 {TrackRequestParamKey::PUBLISHER_PRIORITY , {}},
156- {TrackRequestParamKey::SUBSCRIBER_PRIORITY , {}},
157- {TrackRequestParamKey::SUBSCRIPTION_FILTER , {}},
158- {TrackRequestParamKey::EXPIRES , {}},
159- {TrackRequestParamKey::GROUP_ORDER , {}},
160- {TrackRequestParamKey::LARGEST_OBJECT , {}},
161- {TrackRequestParamKey::FORWARD , {}},
207+ {TrackRequestParamKey::SUBSCRIBER_PRIORITY ,
208+ kAllowedFramesForSubscriberPriority },
209+ {TrackRequestParamKey::SUBSCRIPTION_FILTER ,
210+ kAllowedFramesForSubscriptionFilter },
211+ {TrackRequestParamKey::EXPIRES , kAllowedFramesForExpires },
212+ {TrackRequestParamKey::GROUP_ORDER , kAllowedFramesForGroupOrder },
213+ {TrackRequestParamKey::LARGEST_OBJECT , kAllowedFramesForLargestObject },
214+ {TrackRequestParamKey::FORWARD , kAllowedFramesForForward },
162215};
163216
164217bool Parameters::isParamAllowed (TrackRequestParamKey key) const {
0 commit comments