Просмотр исходного кода

fix CodeQL problem "Database query built from user-controlled sources"

Yuki Takei 11 месяцев назад
Родитель
Сommit
e09113adc8
1 измененных файлов с 5 добавлено и 1 удалено
  1. 5 1
      apps/app/src/features/openai/server/routes/thread.ts

+ 5 - 1
apps/app/src/features/openai/server/routes/thread.ts

@@ -42,8 +42,12 @@ export const createThreadHandlersFactory: CreateThreadFactory = (crowi) => {
         return res.apiv3Err(new ErrorV3('GROWI AI is not enabled'), 501);
         return res.apiv3Err(new ErrorV3('GROWI AI is not enabled'), 501);
       }
       }
 
 
+      const { aiAssistantId, initialUserMessage } = req.body;
+
+      // already asserted aiAssistantId is a string by express-validator
+      assert(typeof aiAssistantId === 'string');
+
       try {
       try {
-        const { aiAssistantId, initialUserMessage } = req.body;
 
 
         const isAiAssistantUsable = await openaiService.isAiAssistantUsable(aiAssistantId, req.user);
         const isAiAssistantUsable = await openaiService.isAiAssistantUsable(aiAssistantId, req.user);
         if (!isAiAssistantUsable) {
         if (!isAiAssistantUsable) {