BE-719 Fix parameter tampering

app/rest/dbroutes.js

@@ -118,7 +118,7 @@ const dbroutes = (router, platform) => {
 			const channel_genesis_hash = req.params.channel_genesis_hash;
 			const blockNum = parseInt(req.params.blocknum);
 			let txid = parseInt(req.params.txid);
-			const orgs = requtil.orgsArrayToString(req.query.orgs);
+			const orgs = requtil.orgsArrayToString(req.query);
 			const { from, to } = requtil.queryDatevalidator(
 				req.query.from,
 				req.query.to
@@ -207,7 +207,7 @@ const dbroutes = (router, platform) => {
 		async (req, res) => {
 			const channel_genesis_hash = req.params.channel_genesis_hash;
 			const blockNum = parseInt(req.params.blocknum);
-			const orgs = requtil.orgsArrayToString(req.query.orgs);
+			const orgs = requtil.orgsArrayToString(req.query);
 			const { from, to } = requtil.queryDatevalidator(
 				req.query.from,
 				req.query.to

app/rest/requestutils.js

@@ -2,6 +2,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+const queryString = require('query-string');
 /**
  *
  *
@@ -88,18 +89,31 @@ function reqPayload(req) {
 	return requestPayload;
 }
 
-const orgsArrayToString = function(orgs) {
+const orgsArrayToString = function(reqQuery) {
 	let temp = '';
-	if (Array.isArray(orgs) || typeof orgs === 'object') {
-		orgs.forEach((element, i) => {
-			temp += `'${element}'`;
-			if (orgs.length - 1 !== i) {
-				temp += ',';
+	if (reqQuery) {
+		// eslint-disable-next-line spellcheck/spell-checker
+		// workaround 'Type confusion through parameter tampering', see `https //lgtm dot com/rules/1506301137371 `
+		const orgsStr = queryString.stringify(reqQuery);
+
+		if (orgsStr) {
+			const parsedReq = queryString.parse(orgsStr);
+			if (parsedReq && parsedReq.orgs) {
+				const orgsArray = parsedReq.orgs.toString().split(',');
+				console.log('requestutils.orgsArrayToString.orgsArray ', orgsArray);
+				// format DB value for IN clause, ex: in ('a', 'b', 'c')
+				if (orgsArray) {
+					orgsArray.forEach((element, i) => {
+						temp += `'${element}'`;
+						if (orgsArray.length - 1 !== i) {
+							temp += ',';
+						}
+					});
+				}
 			}
-		});
-	} else if (orgs) {
-		temp = `'${orgs}'`;
+		}
 	}
+	console.log('comma separated organizations: ', temp);
 	return temp;
 };
 

lgtm.yml

@@ -1,3 +1,4 @@
+
 # SPDX-License-Identifier: Apache-2.0
 
 
@@ -7,6 +8,7 @@ queries:
   - exclude: "js/stack-trace-exposure"
   - exclude: "js/useless-assignment-to-local"
   - exclude: "js/react/unused-or-undefined-state-property"
+  - exclude: "js/superfluous-trailing-arguments"
 extraction:
   javascript:
     index:

package.json

@@ -45,6 +45,7 @@
 		"pg-pool": "^2.0.7",
 		"prettyjson": "^1.2.1",
 		"prop-types": "^15.6.2",
+		"query-string": "^6.9.0",
 		"save": "^2.3.3",
 		"stomp-broker-js": "^0.1.3",
 		"stompjs": "^2.3.3",