improve input validation on PUT /flags

HackerDom · Aug 24, 2023 · 678419c · 678419c
1 parent d9347c2
commit 678419c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/lib/CS/Controller/Flags.pm b/lib/CS/Controller/Flags.pm
@@ -17,7 +17,10 @@ sub put {
   return $c->render(json => {status => \0, msg => "Invalid token '$token'"}, status => 400)
     unless my $team = $c->pg->db->select('teams', ['id'], {token => $token})->hash;
 
-  my $flags = $c->req->json // [];
+  my $flags = $c->req->json;
+  return $c->render(json => {status => \0, msg => 'Invalid format'}, status => 400)
+    unless ref $flags eq 'ARRAY';
+
   my $results = [];
 
   my $do;

diff --git a/t/basic.t b/t/basic.t
@@ -315,4 +315,6 @@ $t->get_ok('/ctftime/scoreboard.json')
 
 $t->get_ok('/ctftime/fb.json');
 
+$t->get_ok('/admin/info');
+
 done_testing;