FC-3063 check objectid is a valid UUID in findType()

farcrycore · Feb 11, 2016 · bdcff5b · bdcff5b
1 parent 1b77606
commit bdcff5b
Showing 1 changed file with 21 additions and 19 deletions.
diff --git a/packages/coapi/coapiUtilities.cfc b/packages/coapi/coapiUtilities.cfc
@@ -151,27 +151,29 @@
  <cfif structKeyExists(variables.stRefobjects, arguments.objectid)>
  <cfset result = variables.stRefobjects[arguments.objectid] />
  <cfelse>
-
- <cfquery datasource="#arguments.dsn#" name="qFindType">
- select typename from #arguments.dbowner#refObjects
- where objectID = <cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.objectID#" />
- </cfquery>
-
- <cfif qFindType.recordCount>
- <cfset result = qFindType.typename />
- <cfelse> 
- <cfif isDefined("Session") AND structKeyExists(Session, "TempObjectStore") 
- AND structKeyExists(Session.TempObjectStore, "#arguments.objectid#")
- AND structKeyExists(Session.TempObjectStore["#arguments.objectid#"], "typename")>
-
- <cfset result = Session.TempObjectStore["#arguments.objectid#"].typename />
+
+ <cfif isValid("uuid", arguments.objectID)>
+ <cfquery datasource="#arguments.dsn#" name="qFindType">
+ select typename from #arguments.dbowner#refObjects
+ where objectID = <cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.objectID#" />
+ </cfquery>
+
+ <cfif qFindType.recordCount>
+ <cfset result = qFindType.typename />
+ <cfelse> 
+ <cfif isDefined("Session") AND structKeyExists(Session, "TempObjectStore") 
+ AND structKeyExists(Session.TempObjectStore, "#arguments.objectid#")
+ AND structKeyExists(Session.TempObjectStore["#arguments.objectid#"], "typename")>
+
+ <cfset result = Session.TempObjectStore["#arguments.objectid#"].typename />
+ </cfif>
+ </cfif> 
+
+ <cfif len(result)>
+ <cfset variables.stRefobjects[arguments.objectid] = result />
  </cfif>
- </cfif> 
-
- <cfif len(result)>
- <cfset variables.stRefobjects[arguments.objectid] = result />
  </cfif>
- 
+
  </cfif>
 
  <cfreturn result />