Merge pull request #178 from Telecominfraproject/WIFI-10551

https://telecominfraproject.atlassian.net/browse/WIFI-10551
Telecominfraproject · Aug 15, 2022 · 055ea2e · 055ea2e
2 parents 2c405c1 + ad8b616
commit 055ea2e
Show file tree

Hide file tree

Showing 6 changed files with 33 additions and 12 deletions.
diff --git a/src/RESTAPI/RESTAPI_blacklist.cpp b/src/RESTAPI/RESTAPI_blacklist.cpp
@@ -18,7 +18,7 @@ namespace OpenWifi {
 	void RESTAPI_blacklist::DoDelete() {
 		auto SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
 
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 
@@ -36,7 +36,7 @@ namespace OpenWifi {
 	void RESTAPI_blacklist::DoGet() {
 		auto SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
 
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 
@@ -83,7 +83,7 @@ namespace OpenWifi {
 
 	void RESTAPI_blacklist::DoPut() {
 		auto SerialNumber = Poco::toLower(GetBinding(RESTAPI::Protocol::SERIALNUMBER, ""));
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 

diff --git a/src/RESTAPI/RESTAPI_commands.cpp b/src/RESTAPI/RESTAPI_commands.cpp
@@ -13,6 +13,10 @@
 namespace OpenWifi {
 	void RESTAPI_commands::DoGet() {
 		auto SerialNumber = GetParameter(RESTAPI::Protocol::SERIALNUMBER, "");
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
+			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
+		}
+
 		std::vector<GWObjects::CommandDetails> Commands;
 		if (QB_.Newest) {
 			StorageService()->GetNewestCommands(SerialNumber, QB_.Limit, Commands);
@@ -33,10 +37,10 @@ namespace OpenWifi {
 
 	void RESTAPI_commands::DoDelete() {
 		auto SerialNumber = GetParameter(RESTAPI::Protocol::SERIALNUMBER, "");
-
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
+
 		if (StorageService()->DeleteCommands(SerialNumber, QB_.StartDate, QB_.EndDate)) {
 			return OK();
 		}

diff --git a/src/RESTAPI/RESTAPI_default_configuration.cpp b/src/RESTAPI/RESTAPI_default_configuration.cpp
@@ -14,10 +14,11 @@
 #include "StorageService.h"
 #include "framework/ow_constants.h"
 #include "framework/ConfigurationValidator.h"
+#include "framework/orm.h"
 
 namespace OpenWifi {
 	void RESTAPI_default_configuration::DoGet() {
-		std::string Name = GetBinding(RESTAPI::Protocol::NAME, "");
+		std::string Name = ORM::Escape(GetBinding(RESTAPI::Protocol::NAME, ""));
 		GWObjects::DefaultConfiguration DefConfig;
 		if (StorageService()->GetDefaultConfiguration(Name, DefConfig)) {
 			Poco::JSON::Object Obj;
@@ -28,7 +29,7 @@ namespace OpenWifi {
 	}
 
 	void RESTAPI_default_configuration::DoDelete() {
-		std::string Name = GetBinding(RESTAPI::Protocol::NAME, "");
+		std::string Name = ORM::Escape(GetBinding(RESTAPI::Protocol::NAME, ""));
 		if(Name.empty()) {
 			return BadRequest(RESTAPI::Errors::MissingOrInvalidParameters);
 		}

diff --git a/src/RESTAPI/RESTAPI_device_commandHandler.cpp b/src/RESTAPI/RESTAPI_device_commandHandler.cpp
@@ -33,6 +33,10 @@ namespace OpenWifi {
 			return BadRequest(RESTAPI::Errors::MissingOrInvalidParameters);
 		}
 
+		if(!Utils::ValidSerialNumber(SerialNumber_)) {
+			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
+		}
+
 		GWObjects::Device	TheDevice;
 		if(!StorageService()->GetDevice(SerialNumber_,TheDevice)) {
 			return NotFound();
@@ -64,6 +68,10 @@ namespace OpenWifi {
 			return BadRequest(RESTAPI::Errors::MissingOrInvalidParameters);
 		}
 
+		if(!Utils::ValidSerialNumber(SerialNumber_)) {
+			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
+		}
+
 		Poco::Thread::current()->setName(fmt::format("{}: {}",SerialNumber_,Command_));
 
 		GWObjects::Device	TheDevice;
@@ -89,6 +97,10 @@ namespace OpenWifi {
 			return BadRequest(RESTAPI::Errors::MissingOrInvalidParameters);
 		}
 
+		if(!Utils::ValidSerialNumber(SerialNumber_)) {
+			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
+		}
+
 		Poco::Thread::current()->setName(fmt::format("{}: {}",SerialNumber_,Command_));
 
 		GWObjects::Device	TheDevice;

diff --git a/src/RESTAPI/RESTAPI_device_handler.cpp b/src/RESTAPI/RESTAPI_device_handler.cpp
@@ -20,7 +20,7 @@ namespace OpenWifi {
 	void RESTAPI_device_handler::DoGet() {
 		std::string SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
 
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 
@@ -42,7 +42,7 @@ namespace OpenWifi {
 	void RESTAPI_device_handler::DoDelete() {
 		std::string SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
 
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 
@@ -86,7 +86,7 @@ namespace OpenWifi {
 	void RESTAPI_device_handler::DoPost() {
 
 		std::string SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 
@@ -149,7 +149,7 @@ namespace OpenWifi {
 	void RESTAPI_device_handler::DoPut() {
 		std::string SerialNumber = GetBinding(RESTAPI::Protocol::SERIALNUMBER, "");
 
-		if(SerialNumber.empty()) {
+		if(!Utils::ValidSerialNumber(SerialNumber)) {
 			return BadRequest(RESTAPI::Errors::MissingSerialNumber);
 		}
 

diff --git a/src/RESTAPI/RESTAPI_devices_handler.cpp b/src/RESTAPI/RESTAPI_devices_handler.cpp
@@ -15,11 +15,13 @@
 #include "framework/MicroService.h"
 #include "RESTAPI/RESTAPI_device_helper.h"
 #include "Poco/StringTokenizer.h"
+#include "framework/orm.h"
 
 namespace OpenWifi {
 
 
-	bool PrepareOrderBy(const std::string &OrderByList, std::string &OrderByString) {
+	bool PrepareOrderBy(const std::string &OrderByListRaw, std::string &OrderByString) {
+		auto OrderByList = ORM::Escape(OrderByListRaw);
 		auto items = Poco::StringTokenizer(OrderByList,",");
 		std::string ItemList;
 
@@ -80,6 +82,8 @@ namespace OpenWifi {
 			Poco::JSON::Array Objects;
 			for (auto &i : SelectedRecords()) {
 				auto SerialNumber = i;
+				if(!Utils::ValidSerialNumber(i))
+					continue;
 				GWObjects::Device D;
 				if (StorageService()->GetDevice(SerialNumber, D)) {
 					if(completeInfo) {