search

VEuPathDB / EdaSubsettingService

A REST service to provide data and subsetting in the Exploratory Data Analysis Workspace
Apache License 2.0
0 stars 0 forks source link

Backend: Add vocabulary check in StringSetFilter #36

Open ryanrdoherty opened 3 years ago

ryanrdoherty commented 3 years ago

This is to prevent SQL injection and alert user to typos in requests, etc. Need only uncomment existing code in StringSetFilter.java:

    // validate values against this var's vocabulary
    /* FIXME: add back at a less risky time, after validating DB data (ClinEpi Phase 2?)
    List<String> vocab = Optional.ofNullable(_variable.getVocabulary())
        .orElseThrow(() -> new RuntimeException("Var " + _variable.getId() + " has null vocabulary."));
    for (String value : _stringSet) {
      if (!vocab.contains(value)) {
        throw new BadRequestException("Value '" + value +
            "' is not in the vocabulary of variable '" +
            _variable.getId() + "' [ " + String.join(", ", vocab) + " ].");
      }
    }*/