Commit a1f82e28 authored by Andrei Mihu's avatar Andrei Mihu
Browse files

Stricter validation of limit in runtime storage list operations.

parent 03d5f356

CHANGELOG.md

+4 −0
Original line number Diff line number Diff line
@@ -4,7 +4,11 @@ All notable changes to this project are documented below. 
The format is based on [keep a changelog](http://keepachangelog.com) and this project uses [semantic versioning](http://semver.org).



## [Unreleased]

### Changed

- Stricter validation of limit in runtime storage list operations.



### Fixed

- Fix response selection in purchase lookups by identifier.



## [3.14.0] - 2022-10-14

### Added

server/core_storage.go

+7 −0
Original line number Diff line number Diff line
@@ -92,6 +92,10 @@ func (s StorageOpDeletes) Less(i, j int) bool { 
}



func StorageListObjects(ctx context.Context, logger *zap.Logger, db *sql.DB, caller uuid.UUID, ownerID *uuid.UUID, collection string, limit int, cursor string) (*api.StorageObjectList, codes.Code, error) {

	if limit <= 0 {

		return &api.StorageObjectList{Objects: make([]*api.StorageObject, 0), Cursor: ""}, codes.OK, nil

	}



	var sc *storageCursor

	if cursor != "" {

		sc = &storageCursor{}
@@ -137,6 +141,9 @@ func StorageListObjects(ctx context.Context, logger *zap.Logger, db *sql.DB, cal 
		return nil, codes.Internal, resultErr

	}



	if cursor != "" && result.Cursor == cursor {

		result.Cursor = ""

	}

	return result, codes.OK, nil

}

server/runtime_go_nakama.go

+4 −0
Original line number Diff line number Diff line
@@ -1881,6 +1881,10 @@ func (n *RuntimeGoNakamaModule) StorageList(ctx context.Context, userID, collect 
		uid = &u

	}



	if limit < 0 {

		return nil, "", errors.New("limit must not be negative")

	}



	objectList, _, err := StorageListObjects(ctx, n.logger, n.db, uuid.Nil, uid, collection, limit, cursor)

	if err != nil {

		return nil, "", err

server/runtime_javascript_nakama.go

+3 −0
Original line number Diff line number Diff line
@@ -4135,6 +4135,9 @@ func (n *runtimeJavascriptNakamaModule) storageList(r *goja.Runtime) func(goja.F 
		if f.Argument(2) != goja.Undefined() && f.Argument(2) != goja.Null() {

			limit = int(getJsInt(r, f.Argument(2)))

		}

		if limit < 0 {

			panic(r.NewTypeError("limit must not be negative"))

		}



		cursor := ""

		if f.Argument(3) != goja.Undefined() && f.Argument(3) != goja.Null() {

server/runtime_lua_nakama.go

+6 −0
Original line number Diff line number Diff line
@@ -5448,7 +5448,13 @@ func (n *RuntimeLuaNakamaModule) walletLedgerList(l *lua.LState) int { 
func (n *RuntimeLuaNakamaModule) storageList(l *lua.LState) int {

	userIDString := l.OptString(1, "")

	collection := l.OptString(2, "")



	limit := l.CheckInt(3)

	if limit < 0 {

		l.ArgError(3, "limit must not be negative")

		return 0

	}



	cursor := l.OptString(4, "")



	var userID *uuid.UUID

server/core_purchase.go

+1 −1

File changed.

Contains only whitespace changes.