Skip to content

Commit e7b40b7

Browse files
Kshitij-KatiyarKshitij-Katiyar
authored
[MI-3423]: Added checks for every post API body (#3)
* [MI-3423]: Added checks for every post API body * [MI-3423]:Fixed review comments * [MI-3423]:Fixed review comments
1 parent e3dc28d commit e7b40b7

File tree

2 files changed

+265
-110
lines changed

2 files changed

+265
-110
lines changed

‎server/plugin.go

+46-110
Original file line numberDiff line numberDiff line change
@@ -163,26 +163,18 @@ func (p *Plugin) checkAuth(handler http.HandlerFunc) http.HandlerFunc {
163163
}
164164
}
165165

166-
type telemetryAPIRequest struct {
167-
Event string
168-
Properties map[string]interface{}
169-
}
170-
171166
func (p *Plugin) handleTelemetry(w http.ResponseWriter, r *http.Request) {
172167
userID := r.Header.Get("Mattermost-User-ID")
173168

174-
var telemetryRequest *telemetryAPIRequest
175-
decoder := json.NewDecoder(r.Body)
176-
err := decoder.Decode(&telemetryRequest)
169+
telemetryRequest, err := GetTelemetryPayloadFromJSON(r.Body)
177170
if err != nil {
178-
p.API.LogError("Unable to decode JSON err=" + err.Error())
179-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
171+
p.API.LogError("Unable to get telemetry payload from JSON err=" + err.Error())
172+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get telemetry payload from JSON.", err)
180173
return
181174
}
182175

183-
if telemetryRequest == nil {
184-
p.API.LogError("Invalid request body")
185-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
176+
if err := IsTelemetryPayloadValid(telemetryRequest); err != nil {
177+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate telemetry payload.", err)
186178
return
187179
}
188180

@@ -191,33 +183,23 @@ func (p *Plugin) handleTelemetry(w http.ResponseWriter, r *http.Request) {
191183
}
192184
}
193185

194-
type addAPIRequest struct {
195-
Message string `json:"message"`
196-
Description string `json:"description"`
197-
SendTo string `json:"send_to"`
198-
PostID string `json:"post_id"`
199-
}
200-
201186
func (p *Plugin) handleAdd(w http.ResponseWriter, r *http.Request) {
202187
userID := r.Header.Get("Mattermost-User-ID")
203188

204-
var addRequest *addAPIRequest
205-
decoder := json.NewDecoder(r.Body)
206-
err := decoder.Decode(&addRequest)
189+
addRequest, err := GetAddIssuePayloadFromJSON(r.Body)
207190
if err != nil {
208-
p.API.LogError("Unable to decode JSON err=" + err.Error())
209-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
191+
p.API.LogError("Unable to get add issue payload from JSON err=" + err.Error())
192+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get add issue payload from JSON.", err)
210193
return
211194
}
212195

213-
senderName := p.listManager.GetUserName(userID)
214-
215-
if addRequest == nil {
216-
p.API.LogError("Invalid request body")
217-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
196+
if err := IsAddIssuePayloadValid(addRequest); err != nil {
197+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate add issue payload.", err)
218198
return
219199
}
220200

201+
senderName := p.listManager.GetUserName(userID)
202+
221203
if addRequest.SendTo == "" {
222204
_, err = p.listManager.AddIssue(userID, addRequest.Message, addRequest.Description, addRequest.PostID)
223205
if err != nil {
@@ -358,26 +340,18 @@ func (p *Plugin) handleList(w http.ResponseWriter, r *http.Request) {
358340
}
359341
}
360342

361-
type editAPIRequest struct {
362-
ID string `json:"id"`
363-
Message string `json:"message"`
364-
Description string `json:"description"`
365-
}
366-
367343
func (p *Plugin) handleEdit(w http.ResponseWriter, r *http.Request) {
368344
userID := r.Header.Get("Mattermost-User-ID")
369345

370-
var editRequest *editAPIRequest
371-
decoder := json.NewDecoder(r.Body)
372-
if err := decoder.Decode(&editRequest); err != nil {
373-
p.API.LogError("Unable to decode JSON err=" + err.Error())
374-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
346+
editRequest, err := GetEditIssuePayloadFromJSON(r.Body)
347+
if err != nil {
348+
p.API.LogError("Unable to get edit issue payload from JSON err=" + err.Error())
349+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get edit issue payload from JSON.", err)
375350
return
376351
}
377352

378-
if editRequest == nil {
379-
p.API.LogError("Invalid request body")
380-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
353+
if err := IsEditIssuePayloadValid(editRequest); err != nil {
354+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate edit issue payload.", err)
381355
return
382356
}
383357

@@ -406,30 +380,18 @@ func (p *Plugin) handleEdit(w http.ResponseWriter, r *http.Request) {
406380
}
407381
}
408382

409-
type changeAssignmentAPIRequest struct {
410-
ID string `json:"id"`
411-
SendTo string `json:"send_to"`
412-
}
413-
414383
func (p *Plugin) handleChangeAssignment(w http.ResponseWriter, r *http.Request) {
415384
userID := r.Header.Get("Mattermost-User-ID")
416385

417-
var changeRequest *changeAssignmentAPIRequest
418-
decoder := json.NewDecoder(r.Body)
419-
if err := decoder.Decode(&changeRequest); err != nil {
420-
p.API.LogError("Unable to decode JSON err=" + err.Error())
421-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
422-
return
423-
}
424-
425-
if changeRequest == nil {
426-
p.API.LogError("Invalid request body")
427-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
386+
changeRequest, err := GetChangeAssignmentPayloadFromJSON(r.Body)
387+
if err != nil {
388+
p.API.LogError("Unable to get change request payload from JSON err=" + err.Error())
389+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get change request from JSON.", err)
428390
return
429391
}
430392

431-
if changeRequest.SendTo == "" {
432-
http.Error(w, "No user specified", http.StatusBadRequest)
393+
if err := IsChangeAssignmentPayloadValid(changeRequest); err != nil {
394+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate change request payload.", err)
433395
return
434396
}
435397

@@ -464,24 +426,18 @@ func (p *Plugin) handleChangeAssignment(w http.ResponseWriter, r *http.Request)
464426
}
465427
}
466428

467-
type acceptAPIRequest struct {
468-
ID string `json:"id"`
469-
}
470-
471429
func (p *Plugin) handleAccept(w http.ResponseWriter, r *http.Request) {
472430
userID := r.Header.Get("Mattermost-User-ID")
473431

474-
var acceptRequest *acceptAPIRequest
475-
decoder := json.NewDecoder(r.Body)
476-
if err := decoder.Decode(&acceptRequest); err != nil {
477-
p.API.LogError("Unable to decode JSON err=" + err.Error())
478-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
432+
acceptRequest, err := GetAcceptRequestPayloadFromJSON(r.Body)
433+
if err != nil {
434+
p.API.LogError("Unable to get accept request payload from JSON err=" + err.Error())
435+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get accept request from JSON.", err)
479436
return
480437
}
481438

482-
if acceptRequest == nil {
483-
p.API.LogError("Invalid request body")
484-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
439+
if err := IsAcceptRequestPayloadValid(acceptRequest); err != nil {
440+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate accept request payload.", err)
485441
return
486442
}
487443

@@ -502,24 +458,18 @@ func (p *Plugin) handleAccept(w http.ResponseWriter, r *http.Request) {
502458
p.PostBotDM(sender, message)
503459
}
504460

505-
type completeAPIRequest struct {
506-
ID string `json:"id"`
507-
}
508-
509461
func (p *Plugin) handleComplete(w http.ResponseWriter, r *http.Request) {
510462
userID := r.Header.Get("Mattermost-User-ID")
511463

512-
var completeRequest *completeAPIRequest
513-
decoder := json.NewDecoder(r.Body)
514-
if err := decoder.Decode(&completeRequest); err != nil {
515-
p.API.LogError("Unable to decode JSON err=" + err.Error())
516-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
464+
completeRequest, err := GetCompleteIssuePayloadFromJSON(r.Body)
465+
if err != nil {
466+
p.API.LogError("Unable to get complete issue request payload from JSON err=" + err.Error())
467+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get complete issue request from JSON.", err)
517468
return
518469
}
519470

520-
if completeRequest == nil {
521-
p.API.LogError("Invalid request body")
522-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
471+
if err := IsCompleteIssuePayloadValid(completeRequest); err != nil {
472+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate complete issue request payload.", err)
523473
return
524474
}
525475

@@ -548,25 +498,18 @@ func (p *Plugin) handleComplete(w http.ResponseWriter, r *http.Request) {
548498
p.PostBotDM(foreignID, message)
549499
}
550500

551-
type removeAPIRequest struct {
552-
ID string `json:"id"`
553-
}
554-
555501
func (p *Plugin) handleRemove(w http.ResponseWriter, r *http.Request) {
556502
userID := r.Header.Get("Mattermost-User-ID")
557503

558-
var removeRequest *removeAPIRequest
559-
decoder := json.NewDecoder(r.Body)
560-
err := decoder.Decode(&removeRequest)
504+
removeRequest, err := GetRemoveIssuePayloadFromJSON(r.Body)
561505
if err != nil {
562-
p.API.LogError("Unable to decode JSON err=" + err.Error())
563-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
506+
p.API.LogError("Unable to get remove issue request payload from JSON err=" + err.Error())
507+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get remove issue request from JSON.", err)
564508
return
565509
}
566510

567-
if removeRequest == nil {
568-
p.API.LogError("Invalid request body")
569-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
511+
if err := IsRemoveIssuePayloadValid(removeRequest); err != nil {
512+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate remove issue request payload.", err)
570513
return
571514
}
572515

@@ -601,25 +544,18 @@ func (p *Plugin) handleRemove(w http.ResponseWriter, r *http.Request) {
601544
p.PostBotDM(foreignID, message)
602545
}
603546

604-
type bumpAPIRequest struct {
605-
ID string `json:"id"`
606-
}
607-
608547
func (p *Plugin) handleBump(w http.ResponseWriter, r *http.Request) {
609548
userID := r.Header.Get("Mattermost-User-ID")
610549

611-
var bumpRequest *bumpAPIRequest
612-
decoder := json.NewDecoder(r.Body)
613-
err := decoder.Decode(&bumpRequest)
550+
bumpRequest, err := GetBumpIssuePayloadFromJSON(r.Body)
614551
if err != nil {
615-
p.API.LogError("Unable to decode JSON err=" + err.Error())
616-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", err)
552+
p.API.LogError("Unable to get bump issue request payload from JSON err=" + err.Error())
553+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to get bump issue request from JSON.", err)
617554
return
618555
}
619556

620-
if bumpRequest == nil {
621-
p.API.LogError("Invalid request body")
622-
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to decode JSON", errors.New("invalid request body"))
557+
if err := IsBumpIssuePayloadValid(bumpRequest); err != nil {
558+
p.handleErrorWithCode(w, http.StatusBadRequest, "Unable to validate bump request payload.", err)
623559
return
624560
}
625561

0 commit comments

Comments
 (0)