Avoid checking non-object fields for nin/in

Wardormeur · Wardormeur · commit 246efb29ce42 · 2018-08-18T17:19:50.000+01:00
diff --git a/service.js b/service.js
@@ -137,19 +137,21 @@ require('./migrate-psql-db.js')(function (err) {
           }
           // Loop over each props
           Object.values(args.q).forEach((value, key) => {
-            const insecureProp = ['nin$', 'in$'];
-            const detected = Object.keys(value).filter((val) => insecureProp.indexOf(val) > -1);
-            if (detected.length > 0) {
-              // Loop over each detected insecureProp being used (nin or in)
-              detected.forEach((col, key) => {
-                const ids = value[col];
-                // Loop over each value of the array of the dangerous field
-                ids.forEach((id) => {
-                  if (!/^[a-zA-Z0-9-]+$/g.test(id)) {
-                    throw new Error(`Unexpected characters in ${col}`);
-                  }
+            if (_.isObject(value)) {
+              const insecureProp = ['nin$', 'in$'];
+              const detected = Object.keys(value).filter((val) => insecureProp.indexOf(val) > -1);
+              if (detected.length > 0) {
+                // Loop over each detected insecureProp being used (nin or in)
+                detected.forEach((col, key) => {
+                  const ids = value[col];
+                  // Loop over each value of the array of the dangerous field
+                  ids.forEach((id) => {
+                    if (!/^[a-zA-Z0-9-]+$/g.test(id)) {
+                      throw new Error(`Unexpected characters in ${col}`);
+                    }
+                  });
                 });
-              });
+              }
             }
           });
           this.prior(args, cb);
