Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add uuid validation at controller level #1660

Merged
merged 1 commit into from
Jul 31, 2024
Merged

Conversation

ludtkemorgan
Copy link
Collaborator

Pull Request Template

Issue Overview

This PR addresses #1659

  • This change addresses the issue in full
  • This change addresses only certain aspects of the issue
  • This change is a dependency for another issue
  • This change has a dependency from another issue

Description

Currently when a string that isn't a UUID is passed into endpoints that take a UUID as a path parameter it gets all the way to the DB layer before an error is thrown. This is dangerous in that a malicious actor could pass in some nefarious string and get close to messing with the database or getting information from the database. We don't believe this could actually happen, but for an extra level of security this PR adds UUID validation at the controller level to stop these calls well before the DB

How Can This Be Tested/Reviewed?

  • Start up the backend and go to swagger http://localhost:3100/docs.
  • Test /listings/{id} endpoint by passing in a string that isn't a UUID
  • The returned error should be a 400 instead of a 500
  • Do the same for /applications/{id} and /user/{id}
  • Also you can test passing in a valid UUID and results should be returned

Checklist:

  • My code follows the style guidelines of this project
  • I have added QA notes to the issue with applicable URLs
  • I have performed a self-review of my own code
  • I have reviewed the changes in a desktop view
  • I have reviewed the changes in a mobile view
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules
  • I have assigned reviewers
  • I have run yarn generate:client and/or created a migration if I made backend changes that require them
  • My commit message(s) is/are polished, and any breaking changes are indicated in the message and are well-described
  • Commits made across packages purposefully have the same commit message/version change, else are separated into different commits

Reviewer Notes:

Steps to review a PR:

  • Read and understand the issue, and ensure the author has added QA notes
  • Review the code itself from a style point of view
  • Pull the changes down locally and test that the acceptance criteria is met
  • Also review the acceptance criteria on the Netlify deploy preview (noting that these do not yet include any backend changes made in the PR)
  • Either explicitly ask a clarifying question, request changes, or approve the PR if there are small remaining changes but the PR is otherwise good to go

On Merge:

If you have one commit and message, squash. If you need each message to be applied, rebase and merge.

Copy link

netlify bot commented Jul 30, 2024

Deploy Preview for detroit-partners-prod ready!

Name Link
🔨 Latest commit a95d980
🔍 Latest deploy log https://app.netlify.com/sites/detroit-partners-prod/deploys/66a952fd1cd10b0009b6952b
😎 Deploy Preview https://deploy-preview-1660--detroit-partners-prod.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link

netlify bot commented Jul 30, 2024

Deploy Preview for detroit-partners-staging ready!

Name Link
🔨 Latest commit a95d980
🔍 Latest deploy log https://app.netlify.com/sites/detroit-partners-staging/deploys/66a952fd287be10008fbc483
😎 Deploy Preview https://deploy-preview-1660--detroit-partners-staging.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link

netlify bot commented Jul 30, 2024

Deploy Preview for detroit-public-staging ready!

Name Link
🔨 Latest commit a95d980
🔍 Latest deploy log https://app.netlify.com/sites/detroit-public-staging/deploys/66a952fd287be10008fbc47f
😎 Deploy Preview https://deploy-preview-1660--detroit-public-staging.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link
Collaborator

@YazeedLoonat YazeedLoonat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ludtkemorgan ludtkemorgan merged commit a3f8884 into main Jul 31, 2024
17 checks passed
@ludtkemorgan ludtkemorgan deleted the 1659/uuid-validation branch July 31, 2024 20:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants