fix validate workflowFn query parameter for API#1239
fix validate workflowFn query parameter for API#1239kochrac wants to merge 2 commits intovercel:mainfrom
Conversation
fix this class of problem, ensure all user-controlled values used as strings are first normalized: if they can be arrays or other types, explicitly check and reject or convert them before calling string methods or using them as keys. For Next.js query parameters, that means verifying the value is a string and not an array of strings (or any other type) before using it.
For this specific file, the best fix is to treat `workflowFn` similarly to the “GOOD” example in the background: check that the value is a string and not an array. Concretely:
- Read `req.query.workflowFn` into a variable that can be `string | string[] | undefined`.
- If the value is an array, reject the request with a 400 error explaining that only a single value is allowed.
- If the value is not a string or is empty, fall back to the default `'simple'` (or return an error, but the current logic already provides a default).
- Only after confirming it is a string, assign it to `workflowFn` and use `.includes('.')`, `.split('.')`, and error messages.
All these changes occur in `workbench/nextjs-webpack/pages/api/trigger-pages.ts`, specifically around lines 34–38 where `workflowFn` is currently derived.
Signed-off-by: kochengrac <[email protected]>
|
|
@kochrac is attempting to deploy a commit to the Vercel Labs Team on Vercel. A member of the Team first needs to authorize it. |
|
@kochrac What problem does this solve? Are you seeing arrays being passed in any case? |
|
this looks like our internal workbench test app. not relevant to workflow usage so I'm not sure why you're making this PR? |
fix this class of problem, ensure all user-controlled values used as strings are first normalized: if they can be arrays or other types, explicitly check and reject or convert them before calling string methods or using them as keys. For Next.js query parameters, that means verifying the value is a string and not an array of strings (or any other type) before using it.
For this specific file, the best fix is to treat
workflowFnsimilarly to the “GOOD” example in the background: check that the value is a string and not an array. Concretely:req.query.workflowFninto a variable that can bestring | string[] | undefined.'simple'(or return an error, but the current logic already provides a default).workflowFnand use.includes('.'),.split('.'), and error messages.All these changes occur in
workbench/nextjs-webpack/pages/api/trigger-pages.ts, specifically around lines 34–38 whereworkflowFnis currently derived.