wazuh / wazuh-api

Wazuh - RESTful API
https://wazuh.com
GNU General Public License v2.0
69 stars 57 forks source link

Error when `ids` parameter is used multiple times when deleting agents #440

Closed druizz90 closed 5 years ago

druizz90 commented 5 years ago

Hi team,

@wazuh/frontend discovered an error when ids parameter was used multiple times when deleting agents:

# curl -u foo:bar -X DELETE "localhost:55000/agents?ids=010&ids=011&ids=012&pretty"
{
   "error": 3,
   "message": "Internal error"
}
# tail -n 15 /var/ossec/logs/api.log 
WazuhAPI 2019-08-26 11:53:04 foo: Internal Error
WazuhAPI 2019-08-26 11:53:04 foo: TypeError: req.query.ids.split is not a function
    at /var/ossec/api/controllers/agents.js:1079:69
    at Layer.handle [as handle_request] (/var/ossec/api/node_modules/express/lib/router/layer.js:95:5)
    at next (/var/ossec/api/node_modules/express/lib/router/route.js:137:13)
    at Route.dispatch (/var/ossec/api/node_modules/express/lib/router/route.js:112:3)
    at Layer.handle [as handle_request] (/var/ossec/api/node_modules/express/lib/router/layer.js:95:5)
    at /var/ossec/api/node_modules/express/lib/router/index.js:281:22
    at Function.process_params (/var/ossec/api/node_modules/express/lib/router/index.js:335:12)
    at next (/var/ossec/api/node_modules/express/lib/router/index.js:275:10)
    at Function.handle (/var/ossec/api/node_modules/express/lib/router/index.js:174:3)
    at router (/var/ossec/api/node_modules/express/lib/router/index.js:47:12)
WazuhAPI 2019-08-26 11:53:04 foo: Exiting...
WazuhAPI 2019-08-26 11:53:04 foo: [::ffff:127.0.0.1] DELETE /agents?ids=010&ids=011&ids=012&pretty - 500 - error: '3'.
WazuhAPI 2019-08-26 11:53:04 foo: Response: {"error":3,"message":"Internal error"} HTTP Status: 500

When we use ids parameter multiple times, a string is not received in line: https://github.com/wazuh/wazuh-api/blob/8d8ffa44e5c160b1cbf6f0fa39e18ca7dc74feb4/controllers/agents.js#L1079 This causes an error when split method is called.

We should consider that this parameter could be different than a string in order to avoid this error.

Best regards,

Demetrio.