[web] Tighten check for spelling language (#19297)

* [web] Tighten check for spelling language

* spelling proxy only for `/check` requests

GitOrigin-RevId: c678e93cca9ad39682ec7ce6e49804ea74741acc
This commit is contained in:
Miguel Serrano 2024-07-08 15:39:33 +02:00 committed by Copybot
parent 2dae2780c1
commit b5e5d39c3a
3 changed files with 33 additions and 72 deletions

View file

@ -28,40 +28,33 @@ module.exports = {
})
},
proxyRequestToSpellingApi(req, res) {
proxyCheckRequestToSpellingApi(req, res) {
const { language } = req.body
let url = req.url.slice('/spelling'.length)
if (!language) {
logger.error({}, '"language" field should be included for spell checking')
return res.status(422).json({ misspellings: [] })
}
if (url === '/check') {
if (!language) {
logger.error(
{},
'"language" field should be included for spell checking'
)
return res.status(422).json({ misspellings: [] })
}
if (!languageCodeIsSupported(language)) {
// this log statement can be changed to 'error' once projects with
// unsupported languages are removed from the DB
logger.debug({ language }, 'language not supported')
return res.status(422).json({ misspellings: [] })
}
if (!languageCodeIsSupported(language)) {
// this log statement can be changed to 'error' once projects with
// unsupported languages are removed from the DB
logger.debug({ language }, 'language not supported')
return res.status(422).json({ misspellings: [] })
}
const userId = SessionManager.getLoggedInUserId(req.session)
url = `/user/${userId}${url}`
const url = `${Settings.apis.spelling.url}/user/${userId}/check`
req.headers.Host = Settings.apis.spelling.host
return request({
url: Settings.apis.spelling.url + url,
method: req.method,
url,
method: 'POST',
headers: req.headers,
json: req.body,
timeout: TEN_SECONDS,
})
.on('error', function (error) {
logger.error({ err: error }, 'Spelling API error')
logger.error({ err: error }, 'Spelling Check API error')
return res.status(500).end()
})
.pipe(res)

View file

@ -1083,7 +1083,7 @@ function initialize(webRouter, privateApiRouter, publicApiRouter) {
webRouter.post(
'/spelling/check',
AuthenticationController.requireLogin(),
SpellingController.proxyRequestToSpellingApi
SpellingController.proxyCheckRequestToSpellingApi
)
webRouter.post(
'/spelling/learn',

View file

@ -56,12 +56,12 @@ describe('SpellingController', function () {
this.res = new MockResponse()
})
describe('proxyRequestToSpellingApi', function () {
describe('proxyCheckRequestToSpellingApi', function () {
describe('on successful call', function () {
beforeEach(function () {
this.req.session.user._id = this.userId = 'user-id-123'
this.req.body = { language: 'en', words: ['blab'] }
this.controller.proxyRequestToSpellingApi(this.req, this.res)
this.controller.proxyCheckRequestToSpellingApi(this.req, this.res)
})
it('should send a request to the spelling host', function () {
@ -89,35 +89,19 @@ describe('SpellingController', function () {
beforeEach(function () {
this.req.session.user._id = this.userId = 'user-id-123'
this.req.body = { language: 'fi', words: ['blab'] }
this.controller.proxyCheckRequestToSpellingApi(this.req, this.res)
})
describe('when the request is a check request', function () {
beforeEach(function () {
this.controller.proxyRequestToSpellingApi(this.req, this.res)
})
it('should not send a request to the spelling host', function () {
this.request.called.should.equal(false)
})
it('should return an empty misspellings array', function () {
this.res.json.calledWith({ misspellings: [] }).should.equal(true)
})
it('should return a 422 status', function () {
this.res.status.calledWith(422).should.equal(true)
})
it('should not send a request to the spelling host', function () {
this.request.called.should.equal(false)
})
describe('when the request is not a check request', function () {
beforeEach(function () {
this.req.url = '/spelling/learn'
this.controller.proxyRequestToSpellingApi(this.req, this.res)
})
it('should return an empty misspellings array', function () {
this.res.json.calledWith({ misspellings: [] }).should.equal(true)
})
it('should send a request to the spelling host', function () {
this.request.called.should.equal(true)
})
it('should return a 422 status', function () {
this.res.status.calledWith(422).should.equal(true)
})
})
@ -125,35 +109,19 @@ describe('SpellingController', function () {
beforeEach(function () {
this.req.session.user._id = this.userId = 'user-id-123'
this.req.body = { words: ['blab'] }
this.controller.proxyCheckRequestToSpellingApi(this.req, this.res)
})
describe('when the request is a check request', function () {
beforeEach(function () {
this.controller.proxyRequestToSpellingApi(this.req, this.res)
})
it('should not send a request to the spelling host', function () {
this.request.called.should.equal(false)
})
it('should return an empty misspellings array', function () {
this.res.json.calledWith({ misspellings: [] }).should.equal(true)
})
it('should return a 422 status', function () {
this.res.status.calledWith(422).should.equal(true)
})
it('should not send a request to the spelling host', function () {
this.request.called.should.equal(false)
})
describe('when the request is not a check request', function () {
beforeEach(function () {
this.req.url = '/spelling/learn'
this.controller.proxyRequestToSpellingApi(this.req, this.res)
})
it('should return an empty misspellings array', function () {
this.res.json.calledWith({ misspellings: [] }).should.equal(true)
})
it('should send a request to the spelling host', function () {
this.request.called.should.equal(true)
})
it('should return a 422 status', function () {
this.res.status.calledWith(422).should.equal(true)
})
})
})