Sultan
/
Flowise
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1372 from FlowiseAI/bugfix/XSS-array-query 

Bugfix/Sanitized &amp
This commit is contained in:
Henry Heng 2023-12-12 16:46:35 +00:00 committed by GitHub
parent dd5034e6a4 8e1ef2d533
commit 6dc7508968
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/server/src/index.ts
View File

@ -200,7 +200,7 @@ export class App {
// Get component credential via name // Get component credential via name
this.app.get('/api/v1/components-credentials/:name', (req: Request, res: Response) => { this.app.get('/api/v1/components-credentials/:name', (req: Request, res: Response) => {
if (!req.params.name.includes('&')) { if (!req.params.name.includes('&')) {
if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, req.params.name)) { if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, req.params.name)) {
return res.json(this.nodesPool.componentCredentials[req.params.name]) return res.json(this.nodesPool.componentCredentials[req.params.name])
} else { } else {
@ -208,7 +208,7 @@ export class App {
} }
} else { } else {
const returnResponse = [] const returnResponse = []
for (const name of req.params.name.split('&')) { for (const name of req.params.name.split('&')) {
if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, name)) { if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, name)) {
returnResponse.push(this.nodesPool.componentCredentials[name]) returnResponse.push(this.nodesPool.componentCredentials[name])
} else { } else {