github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-07 20:31:06 -05:00
Code Issues Projects Releases Packages Wiki Activity

check for null bytes from JSON.stringify

Browse source
This commit is contained in:
Brian Gough 2017-06-01 11:27:56 +01:00
parent db824d9730
commit ab6fe1d948
2 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/real-time/app/coffee/DocumentUpdaterManager.coffee
View file

@ -54,6 +54,10 @@ module.exports = DocumentUpdaterManager =
queueChange: (project_id, doc_id, change, callback = ()->)->
jsonChange = JSON.stringify change
if jsonChange.indexOf("\u0000") != -1
error = new Error("null bytes found in op")
logger.error err: error, project_id: project_id, doc_id: doc_id, jsonChange: jsonChange, error.message
return callback(error)
doc_key = "#{project_id}:#{doc_id}"
# Push onto pendingUpdates for doc_id first, because once the doc updater
# gets an entry on pending-updates-list, it starts processing.

16
services/real-time/test/unit/coffee/DocumentUpdaterManagerTests.coffee
View file

@ -17,7 +17,8 @@ describe 'DocumentUpdaterManager', ->
pendingUpdates: ({doc_id}) -> "PendingUpdates:#{doc_id}"
@rclient = {auth:->}
@DocumentUpdaterManager = SandboxedModule.require modulePath, requires:
@DocumentUpdaterManager = SandboxedModule.require modulePath,
requires:
'settings-sharelatex':@settings
'logger-sharelatex': @logger = {log: sinon.stub(), error: sinon.stub(), warn: sinon.stub()}
'request': @request = {}
@ -25,6 +26,8 @@ describe 'DocumentUpdaterManager', ->
'metrics-sharelatex': @Metrics =
Timer: class Timer
done: () ->
globals:
JSON: @JSON = Object.create(JSON) # avoid modifying JSON object directly
describe "getDocument", ->
beforeEach ->
@ -147,3 +150,14 @@ describe 'DocumentUpdaterManager', ->
it "should return an error", ->
@callback.calledWithExactly(sinon.match(Error)).should.equal true
describe "with null byte corruption", ->
beforeEach ->
@JSON.stringify = () -> return '["bad bytes! \u0000 <- here"]'
@DocumentUpdaterManager.queueChange(@project_id, @doc_id, @change, @callback)
it "should return an error", ->
@callback.calledWithExactly(sinon.match(Error)).should.equal true
it "should not push the change onto the pending-updates-list queue", ->
@rclient.rpush.called.should.equal false