Skip to content

Commit

Permalink
fix final security warnings
Browse files Browse the repository at this point in the history
  • Loading branch information
pelazas committed Mar 8, 2024
1 parent 26c295b commit ca4251f
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 24 deletions.
2 changes: 1 addition & 1 deletion gatewayservice/gateway-service.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ describe('Gateway Service', () => {
.post('/adduser')
.send({ username: 'newuser', password: 'newpassword' });

// expect(response.statusCode).toBe(200);

expect(response.body.userId).toBe('mockedUserId');
});

Expand Down
43 changes: 20 additions & 23 deletions users/userservice/UserController.js
Original file line number Diff line number Diff line change
Expand Up @@ -6,32 +6,29 @@ const isValidUuidV4 = require('./util/ValidateUUID');

let UserController = {
updateLastGame: async (req, res) => {
const { gameUUID, players } = req.body;
for (const p of players) {
try {
let user;

const isValid = isValidUuidV4(p.uuid);
if(!isValid){
throw new Error(`Invalid UUID provided`);
}

user = await User.findOne({ uuid: p.uuid });
const { gameUUID, players } = req.body;

if (user) {
user.lastGameId = gameUUID;
await user.save();
} else {
throw new Error(`User with UUID ${p.uuid} not found.`);
}
} catch (error) {
return res.status(500).json({ error: error.message });
}

for (const p of players) {
try {
const isValid = isValidUuidV4(p.uuid);
if (!isValid) {
throw new Error(`Invalid UUID provided`);
}
const user = await User.findOne({ uuid: p.uuid });

if (user) {

Check failure

Code scanning / SonarCloud

NoSQL operations should not be vulnerable to injection attacks High

Change this code to not construct database queries directly from user-controlled data. See more on SonarCloud
user.lastGameId = gameUUID;
await user.save();
} else {
throw new Error(`User with UUID ${p.uuid} not found`);
}
} catch (error) {
return res.status(500).json({ error: error.message });
}
}

const nPlayers = players.length;
res.json({ "message": `Last game updated for ${nPlayers} users.` });
const nPlayers = players.length;
res.json({ message: `Last game updated for ${nPlayers} users.` });
},
addUser: async (req, res) => {
try {
Expand Down

0 comments on commit ca4251f

Please sign in to comment.