fix(projects-service): Validate project IDs in container endpoints

fujaba · Oct 13, 2023 · 11af60c · 11af60c
1 parent b417e8f
commit 11af60c
Showing 1 changed file with 9 additions and 6 deletions.
diff --git a/services/apps/projects/src/container/container.controller.ts b/services/apps/projects/src/container/container.controller.ts
@@ -65,28 +65,31 @@ export class ContainerController {
   @NotFound()
   @ApiOkResponse({type: ContainerDto})
   async findOne(
-    @Param('id') id: string,
+    @Param('id', ObjectIdPipe) id: Types.ObjectId,
     @AuthUser() user: UserToken,
   ): Promise<ContainerDto | null> {
-    return this.containerService.findOne(id, user.sub);
+    return this.containerService.findOne(id.toString(), user.sub);
   }
 
   @Delete('projects/:id/container')
   @MemberAuth({forbiddenResponse})
   @NotFound()
   @ApiOkResponse({type: ContainerDto})
   async remove(
-    @Param('id') id: string,
+    @Param('id', ObjectIdPipe) id: Types.ObjectId,
     @AuthUser() user: UserToken,
   ): Promise<ContainerDto | null> {
-    return this.containerService.remove(id, user.sub);
+    return this.containerService.remove(id.toString(), user.sub);
   }
 
   @Post('projects/:id/zip')
   @ApiOperation({summary: 'Upload a zip file to add files to a project'})
   @ProjectAuth({forbiddenResponse: 'Not owner of project.'})
   @UseInterceptors(FileInterceptor('file'))
-  async unzip(@Param('id') id: string, @UploadedFile() file: Express.Multer.File): Promise<any | null> {
-    return this.containerService.unzip(id, file);
+  async unzip(
+    @Param('id', ObjectIdPipe) id: Types.ObjectId,
+    @UploadedFile() file: Express.Multer.File,
+  ): Promise<any | null> {
+    return this.containerService.unzip(id.toString(), file);
   }
 }