yuanhau/news-analyze
1
0
Fork 0
mirror of https://github.com/hpware/news-analyze.git synced 2025-06-23 21:14:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add getUserTokenMinusSQLInjection to prevent SQL Injection in via the
Some checks are pending
Build and Push Docker Image / build-and-push (push) Waiting to run
Details

Browse source 
cookies (that may be not possible, but it is a safety guard I want to
add. (Chat: https://t3.chat/chat/c1883e6a-6c38-4af3-9818-0e927449c61c)
This commit is contained in:
yuanhau 2025-06-10 09:39:11 +08:00
parent bd3a81dfbc
commit 2895263e52
10 changed files with 90 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

18
server/api/user/submitGroqKey.ts
View file

@ -1,19 +1,11 @@
import sql from "~/server/components/postgres";
import getUserTokenMinusSQLInjection from "~/server/components/getUserToken";
export default defineEventHandler(async (event) => {
// Check user data.
const userToken = getCookie(event, "token");
if (!userToken) {
const user = getUserTokenMinusSQLInjection(event);
if (user.error.length !== 0) {
return {
error: "ERR_NOT_ALLOWED",
};
}
const checkUserToken = await sql`
select * from usertokens
where token=${userToken}
`;
if (checkUserToken.length === 0) {
return {
error: "ERR_NOT_ALLOWED",
error: user.error,
};
}
// Actual function
@ -26,7 +18,7 @@ export default defineEventHandler(async (event) => {
`
UPDATE user_other_data SET ${requestChange} = $1
WHERE username = $2`,
[apiKeyqq[0], checkUserToken[0].username],
[apiKeyqq[0], user.user],
);
return {
body: body,