Patches XSS vulnerability found in team mngmt API routes

README.md

@@ -36,8 +36,9 @@ Main features:
 - Exclusive Slack App to control and test changes.
 
 
-- **JavaScript lib**: (https://github.com/switcherapi/switcher-client-master)
-- **Java lib**: (https://github.com/switcherapi/switcher-client)
+- **JS Client SDK**: (https://github.com/switcherapi/switcher-client-js)
+- **Deno Client SDK**: (https://github.com/switcherapi/switcher-client-deno)
+- **Java Client SDK**: (https://github.com/switcherapi/switcher-client-java)
 - **Switcher Management**: (https://github.com/switcherapi/switcher-management)
 - **Switcher Slack App**: (https://github.com/switcherapi/switcher-slack-app)
 

eslint.config.js

@@ -1,13 +1,13 @@
-import js from "@eslint/js";
-import globals from "globals";
+import js from '@eslint/js';
+import globals from 'globals';
 
 export default [
     {
         ...js.configs.recommended,
-        files: ["src/**/*.js"]
+        files: ['src/**/*.js']
     },
     {
-        files: ["src/**/*.js"],
+        files: ['src/**/*.js'],
         rules: {
             quotes: ['error', 'single'],
             semi: ['error', 'always'],

src/routers/team.js

@@ -1,6 +1,6 @@
 import express from 'express';
 import { auth } from '../middleware/auth.js';
-import { check, query } from 'express-validator';
+import { body, check, query } from 'express-validator';
 import { ActionTypes, RouterTypes } from '../models/permission.js';
 import { validate, verifyInputUpdateParameters } from '../middleware/validators.js';
 import { verifyOwnership } from '../helpers/index.js';
@@ -148,7 +148,8 @@ router.delete('/team/member/invite/remove/:id/:request_id', auth, [
 });
 
 router.patch('/team/member/add/:id', auth, [
-    check('id').isMongoId()
+    check('id').isMongoId(),
+    body('member').isMongoId()
 ], validate, verifyInputUpdateParameters(['member']), async (req, res) => {
     try {
         const adminMember = await Services.addTeamMember(req.body.member, req.params.id, req.admin);
@@ -159,7 +160,8 @@ router.patch('/team/member/add/:id', auth, [
 });
 
 router.patch('/team/member/remove/:id', auth, [
-    check('id').isMongoId()
+    check('id').isMongoId(),
+    body('member').isMongoId()
 ], validate, verifyInputUpdateParameters(['member']), async (req, res) => {
     try {
         const adminMember = await Services.removeTeamMember(req.body.member, req.params.id, req.admin);
@@ -170,7 +172,8 @@ router.patch('/team/member/remove/:id', auth, [
 });
 
 router.patch('/team/permission/remove/:id', auth, [
-    check('id').isMongoId()
+    check('id').isMongoId(),
+    body('permission').isMongoId()
 ], validate, verifyInputUpdateParameters(['permission']), async (req, res) => {
     try {
         const team = await Services.removeTeamPermission(req.body.permission, req.params.id, req.admin);

tests/team.test.js

@@ -448,7 +448,7 @@ describe('Updating team members tests', () => {
         await request(app)
             .patch(`/team/member/add/${team1Id}`)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
-            .send().expect(400);
+            .send().expect(422);
     });
 
     test('TEAM_SUITE - Should NOT add a team member - Member already joined', async () => {
@@ -461,12 +461,21 @@ describe('Updating team members tests', () => {
     });
 
     test('TEAM_SUITE - Should NOT add a team member - Invalid parameter', async () => {
+        // Test - invalid parameter key
         await request(app)
             .patch(`/team/member/add/${team1Id}`)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
             .send({
                 admin: adminAccountId
-            }).expect(400);
+            }).expect(422);
+
+        // Test - invalid parameter value
+        await request(app)
+            .patch(`/team/member/add/${team1Id}`)
+            .set('Authorization', `Bearer ${adminMasterAccountToken}`)
+            .send({
+                member: 'INVALID_ID'
+            }).expect(422);
     });
 
     test('TEAM_SUITE - Should NOT remove a team member - Team not found', async () => {
@@ -509,16 +518,25 @@ describe('Updating team members tests', () => {
         await request(app)
             .patch(`/team/member/remove/${team1Id}`)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
-            .send().expect(400);
+            .send().expect(422);
     });
 
     test('TEAM_SUITE - Should NOT remove a team member - Invalid parameter', async () => {
+        // Test - invalid parameter key
         await request(app)
             .patch(`/team/member/remove/${team1Id}`)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
             .send({
                 admin: adminAccountId
-            }).expect(400);
+            }).expect(422);
+
+        // Test - invalid parameter value
+        await request(app)
+            .patch(`/team/member/remove/${team1Id}`)
+            .set('Authorization', `Bearer ${adminMasterAccountToken}`)
+            .send({
+                member: 'INVALID_ID'
+            }).expect(422);
     });
 
     test('TEAM_SUITE - Should remove a team member', async () => {
@@ -650,12 +668,21 @@ describe('Updating team permissions tests', () => {
     });
 
     test('TEAM_SUITE - Should NOT remove a permission - Invalid parameter', async () => {
+        // Test - invalid parameter key
         await request(app)
             .patch(`/team/permission/remove/${team1Id}`)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
             .send({
                 member: permission1Id
-            }).expect(400);
+            }).expect(422);
+
+        // Test - invalid parameter value
+        await request(app)
+            .patch(`/team/permission/remove/${team1Id}`)
+            .set('Authorization', `Bearer ${adminMasterAccountToken}`)
+            .send({
+                permission: 'INVALID_ID'
+            }).expect(422);
     });
 
     test('TEAM_SUITE - Should NOT remove a permission - Permission not found', async () => {