Skip to content

[BREAK] Validate incoming message schema #9922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rodrigok merged 10 commits into from
Apr 21, 2018
Merged

[BREAK] Validate incoming message schema #9922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c7a169e
Feb 27, 2018
b42d221
fix required parameters and add more tests cases.
Feb 27, 2018
c8d047a
Added the same validation to chat.sendMessage method too.
Feb 28, 2018
ad512fb
Mar 2, 2018
2c2f4e7
Merge branch 'develop' into fix-rest-api-chat-postmessage-validations
Mar 27, 2018
392729f
Merge commit 'a9fb4da5c847a456990a5d60369f0f52ff4a8bd8' into fix-rest…
Apr 19, 2018
be4a6ef
Improvements in the sendMessage function, removed underscore uses, an…
Apr 19, 2018
e957d88
Merge branch 'develop' into fix-rest-api-chat-postmessage-validations
Apr 20, 2018
c770bf4
Fix test in chat.sendMessage endpoint, and fix error in sendMessage f…
Apr 20, 2018
d948c97
fix review
ggazzo Apr 20, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/rocketchat-api/server/v1/chat.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
/* global processWebhookMessage */

RocketChat.API.v1.addRoute('chat.delete', { authRequired: true }, {
post() {
check(this.bodyParams, Match.ObjectIncluding({
Expand Down
61 changes: 57 additions & 4 deletions packages/rocketchat-lib/server/functions/sendMessage.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,66 @@
import _ from 'underscore';
const validateAttachmentsFields = attachmentFields => {
Copy link
Contributor

@graywolf336 graywolf336 Apr 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ggazzo why did you change the code style from parenthesis around the arguments to not?

Copy link
Member

@ggazzo ggazzo Apr 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because we dont need ( )in this case :)

check(attachmentFields, Match.ObjectIncluding({
short: Match.Maybe(Boolean),
title: String,
value: String
}));
};

const validateAttachment = attachment => {
check(attachment, Match.ObjectIncluding({
color: Match.Maybe(String),
text: Match.Maybe(String),
ts: Match.Maybe(String),
thumb_url: Match.Maybe(String),
message_link: Match.Maybe(String),
collapsed: Match.Maybe(Boolean),
author_name: Match.Maybe(String),
author_link: Match.Maybe(String),
author_icon: Match.Maybe(String),
title: Match.Maybe(String),
title_link: Match.Maybe(String),
title_link_download: Match.Maybe(Boolean),
image_url: Match.Maybe(String),
audio_url: Match.Maybe(String),
video_url: Match.Maybe(String)
}));
if (attachment.fields.length) {
attachment.fields.map(validateAttachmentsFields);
}
};

const validateBodyAttachments = attachments => attachments.map(validateAttachment);

RocketChat.sendMessage = function(user, message, room, upsert = false) {
if (!user || !message || !room._id) {
return false;
}

check(message, Match.ObjectIncluding({
_id: Match.Maybe(String),
msg: Match.Maybe(String),
text: Match.Maybe(String),
alias: Match.Maybe(String),
emoji: Match.Maybe(String),
avatar: Match.Maybe(String),
attachments: Match.Maybe(Array)
}));

if (Array.isArray(message.attachments) && message.attachments.length) {
validateBodyAttachments(message.attachments);
}

if (!message.ts) {
message.ts = new Date();
}
const { _id, username, name } = user;
message.u = {
_id,
username,
name
};
message.rid = room._id;

if (!Match.test(message.msg, String)) {
message.msg = '';
}
Expand All @@ -13,9 +69,6 @@ RocketChat.sendMessage = function(user, message, room, upsert = false) {
message.ts = new Date();
}

message.rid = room._id;
message.u = _.pick(user, ['_id', 'username', 'name']);

if (!room.usernames || room.usernames.length === 0) {
const updated_room = RocketChat.models.Rooms.findOneById(room._id);
if (updated_room) {
Expand Down
6 changes: 5 additions & 1 deletion packages/rocketchat-lib/server/methods/sendMessage.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ Meteor.methods({
});
}

if (!message.rid) {
throw new Error('The \'rid\' property on the message object is missing.');
}

if (message.ts) {
const tsDiff = Math.abs(moment(message.ts).diff());
if (tsDiff > 60000) {
Expand Down Expand Up @@ -54,7 +58,7 @@ Meteor.methods({
return false;
}

if ((room.muted||[]).includes(user.username)) {
if ((room.muted || []).includes(user.username)) {
RocketChat.Notifications.notifyUser(Meteor.userId(), 'message', {
_id: Random.id(),
rid: room._id,
Expand Down
Loading