Merge pull request #9 from ECTwo/aws/cmd-injection

Fix #5, Prevent command injection

.gitignore

@@ -28,3 +28,7 @@ coverage
 
 # Benchmarking
 benchmarks/graphs
+
+# IntelliJ
+.idea/
+*.iml

src/routes/index.ts

@@ -5,6 +5,19 @@ import AwsTerraformRouterV1 from './v1/terraform/Aws';
 // Init router and path
 const router = Router();
 
+router.use((req, res, next) => {
+    const { access_key, secret_key } = req.headers;
+    if (typeof access_key === 'string' && !access_key.match(/^[A-Za-z0-9]+$/)) {
+        res.status(400).end(JSON.stringify({}));
+        return;
+    }
+    if (typeof secret_key === 'string' && !secret_key.match(/^[A-Za-z0-9]+$/)) {
+        res.status(400).end(JSON.stringify({}));
+        return;
+    }
+    next();
+});
+
 // Add sub-routes
 router.use('/users', UserRouter);
 router.use('/v1/aws', AwsRouterV1)