Skip to content

Commit

Permalink
fix(backend): Fix parsing user ID to uint32
Browse files Browse the repository at this point in the history
The error was introduced in fc48ea6
which addressed the CodeQL finding that casting int64 to int32 was bad.
  • Loading branch information
marekful committed May 4, 2023
1 parent b8dee9b commit 40188f3
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 6 deletions.
6 changes: 3 additions & 3 deletions backend/cmd/users.go
Original file line number Diff line number Diff line change
Expand Up @@ -52,12 +52,12 @@ func printUsers(usrs []*users.User) {
w.Flush()
}

func parseUsernameOrID(arg string) (username string, id uint64) {
id64, err := strconv.ParseUint(arg, 10, 64)
func parseUsernameOrID(arg string) (username string, id uint) {
rawID, err := strconv.Atoi(arg)
if err != nil {
return arg, 0
}
return "", id64
return "", uint(rawID)
}

func addUserFlags(flags *pflag.FlagSet) {
Expand Down
10 changes: 7 additions & 3 deletions backend/http/agents.go
Original file line number Diff line number Diff line change
Expand Up @@ -116,13 +116,17 @@ func withAgentUser(fn handleFunc) handleFunc {

// Fetch the user referred to in query params
vars := mux.Vars(r)
userID := vars["user_id"]
id64, err := strconv.ParseUint(userID, 10, 64)
userID, set := vars["user_id"]
if !set {
return http.StatusUnauthorized, nil
}

rawID, err := strconv.Atoi(userID)
if err != nil {
return http.StatusUnauthorized, nil
}

user, dErr := d.store.Users.Get(d.server.Root, id64)
user, dErr := d.store.Users.Get(d.server.Root, uint(rawID))
if dErr != nil {
return http.StatusUnauthorized, nil
}
Expand Down

0 comments on commit 40188f3

Please sign in to comment.