mai
/
posimai-root
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: add URL protocol validation and reaction type validation

This commit is contained in:
posimai 2026-03-17 17:26:59 +09:00
parent 9e1a817ed6
commit a60dda9528
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server.js
View File

@ -1424,6 +1424,10 @@ ${excerpt}
r.post('/together/share', async (req, res) => { r.post('/together/share', async (req, res) => {
const { group_id, shared_by, url = null, title = null, message = '', tags = [] } = req.body || {}; const { group_id, shared_by, url = null, title = null, message = '', tags = [] } = req.body || {};
if (!group_id || !shared_by) return res.status(400).json({ error: 'group_id と shared_by は必須です' }); if (!group_id || !shared_by) return res.status(400).json({ error: 'group_id と shared_by は必須です' });
if (url) {
try { const p = new URL(url); if (!['http:', 'https:'].includes(p.protocol)) throw new Error(); }
catch { return res.status(400).json({ error: 'url は http/https のみ有効です' }); }
}
try { try {
const grpCheck = await pool.query('SELECT id FROM together_groups WHERE id=$1', [group_id]); const grpCheck = await pool.query('SELECT id FROM together_groups WHERE id=$1', [group_id]);
if (grpCheck.rows.length === 0) return res.status(404).json({ error: 'グループが見つかりません' }); if (grpCheck.rows.length === 0) return res.status(404).json({ error: 'グループが見つかりません' });
@ -1488,6 +1492,7 @@ ${excerpt}
r.post('/together/react', async (req, res) => { r.post('/together/react', async (req, res) => {
const { share_id, username, type = 'like' } = req.body || {}; const { share_id, username, type = 'like' } = req.body || {};
if (!share_id || !username) return res.status(400).json({ error: 'share_id と username は必須です' }); if (!share_id || !username) return res.status(400).json({ error: 'share_id と username は必須です' });
if (!['like', 'star', 'fire'].includes(type)) return res.status(400).json({ error: 'type は like/star/fire のみ有効です' });
try { try {
const existing = await pool.query( const existing = await pool.query(
'SELECT 1 FROM together_reactions WHERE share_id=$1 AND username=$2 AND type=$3', 'SELECT 1 FROM together_reactions WHERE share_id=$1 AND username=$2 AND type=$3',