Stricter report_id validation #788
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
hellais
reviewed
Sep 15, 2022
| @@ -40,7 +40,7 @@ export async function getServerSideProps({ query }) { | |||
| // in which case, the extra segments are available inside query.report_id[1+] | |||
| const report_id = query?.report_id?.[0] | |||
| // If there is no report_id to use, fail early with MeasurementNotFound | |||
| if (typeof report_id !== 'string' || report_id.length < 1) { | |||
| if (typeof report_id !== 'string' || !report_id.match(/[a-zA-Z0-9_-]{5,100}/)) { | |||
There was a problem hiding this comment.
I think we can be even a bit more aggressive with the filter here by setting the minimum length to 40 (according to the fastpath table the shortest non-null report_id is 45 characters, and it's of the new format 20201028T073929Z_ndt_ZZ_0_n1_Ed95brGpL3sZ4dUN, so even in the case of a single character test name we would be at 43 chars).
hellais
approved these changes
Sep 15, 2022
majakomel
force-pushed
the
report-id-regex
branch
from
6d07ef1
to
2ae5c58
Compare
majakomel
force-pushed
the
report-id-regex
branch
from
2ae5c58
to
0a94866
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds stricter report_id regex to avoid making unnecessary api requests.
Regex matches the one on the backend: ooni/api#301