From 5187b63771ec47e914523147e2d4d7c174cbcc56 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Sun, 13 Nov 2022 12:05:17 +0100 Subject: [PATCH] Harden record value processing This commit adds extra checks and for null/object/array types. NULL values are gracefuly ignored whn found on root or under an attribute. --- store/adapters/rdbms/drivers/columns.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/store/adapters/rdbms/drivers/columns.go b/store/adapters/rdbms/drivers/columns.go index 0c8d4723e..bfd28d93d 100644 --- a/store/adapters/rdbms/drivers/columns.go +++ b/store/adapters/rdbms/drivers/columns.go @@ -5,6 +5,7 @@ import ( "encoding/json" "fmt" "github.com/cortezaproject/corteza-server/pkg/dal" + "github.com/cortezaproject/corteza-server/pkg/errors" "github.com/spf13/cast" "github.com/valyala/fastjson" ) @@ -180,6 +181,15 @@ func (c *SimpleJsonDocColumn) Decode(raw any, r dal.ValueSetter) (err error) { return } + if root.Type() == fastjson.TypeNull { + // ignore NULL + return + } + + if root.Type() != fastjson.TypeObject { + return errors.InvalidData("expecting valid JSON object for record-values") + } + if obj, err = root.Object(); err != nil { return } @@ -191,6 +201,15 @@ func (c *SimpleJsonDocColumn) Decode(raw any, r dal.ValueSetter) (err error) { continue } + if auxvv.Type() == fastjson.TypeNull { + // ignore NULL + return + } + + if auxvv.Type() != fastjson.TypeArray { + return errors.InvalidData("expecting valid JSON array for record-values at key %s, got %s", attr.Ident, root.Type()) + } + if vv, err = auxvv.Array(); err != nil { return }