Закрыта дыра безопасности

2020-02-11 13:02:43 +07:00
parent 2484568b21
commit 1bcd902817
4 changed files with 12 additions and 5 deletions
--- a/server/controllers/WebSocketController.js
+++ b/server/controllers/WebSocketController.js
@@ -98,7 +98,9 @@ class WebSocketController {

    async getConfig(req, ws) {
        if (Array.isArray(req.params)) {
-            this.send(_.pick(this.config, req.params), req, ws);
+            const paramsSet = new Set(req.params);
+
+            this.send(_.pick(this.config, this.config.webConfigParams.filter(x => paramsSet.has(x))), req, ws);
        } else {
            throw new Error('params is not an array');
        }