瀏覽代碼

fix CodeQL problem "Database query built from user-controlled sources"

Yuki Takei 1 年之前
父節點
當前提交
e09113adc8
共有 1 個文件被更改,包括 5 次插入1 次删除
  1. 5 1
      apps/app/src/features/openai/server/routes/thread.ts

+ 5 - 1
apps/app/src/features/openai/server/routes/thread.ts

@@ -42,8 +42,12 @@ export const createThreadHandlersFactory: CreateThreadFactory = (crowi) => {
         return res.apiv3Err(new ErrorV3('GROWI AI is not enabled'), 501);
       }
 
+      const { aiAssistantId, initialUserMessage } = req.body;
+
+      // already asserted aiAssistantId is a string by express-validator
+      assert(typeof aiAssistantId === 'string');
+
       try {
-        const { aiAssistantId, initialUserMessage } = req.body;
 
         const isAiAssistantUsable = await openaiService.isAiAssistantUsable(aiAssistantId, req.user);
         if (!isAiAssistantUsable) {