Sec fix

I-TECH-UW · Oct 16, 2023 · 1e7e2b6 · 1e7e2b6
1 parent 8aa9f3e
commit 1e7e2b6
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/routes/fhir.ts b/src/routes/fhir.ts
@@ -25,14 +25,18 @@ router.get('/:resource/:id?/:operation?', async (req, res) => {
       return res.status(400).json({ message: `Invalid resource type ${req.params.resource}` })
     }
 
-    if (req.params.id) {
+    if (req.params.id && /^[a-zA-Z0-9\-_]+$/.test(req.params.id)) {
       uri = uri.segment(encodeURIComponent(req.params.id))
+    } else {
+      return res.status(400).json({ message: `Invalid resource id ${req.params.id}` })
     }
 
     for (const param in req.query) {
       let value = req.query[param]
-      if(value) {
+      if(value && /^[a-zA-Z0-9\-_]+$/.test(value.toString())) {
         uri.addQuery(param, encodeURIComponent(value.toString()))
+      } else {
+        return res.status(400).json({ message: `Invalid query parameter ${param}=${value}` })
       }
     }