Merge pull request #1432 from CVEProject/emathew/1401-registryOrg-admin-error

Resolves issue 1401, Validates the request body for registryOrg POST request

Author: david-rocca

src/controller/registry-org.controller/index.js

@@ -5,7 +5,7 @@ const errorMsgs = require('../../middleware/errorMessages')
 const { body, param, query } = require('express-validator')
 const controller = require('./registry-org.controller')
 const { parseGetParams, parsePostParams, parseDeleteParams, parseError, isOrgRole } = require('./registry-org.middleware')
-const { toUpperCaseArray, isFlatStringArray } = require('../../middleware/middleware')
+const { toUpperCaseArray, toLowerCaseArray, isFlatStringArray } = require('../../middleware/middleware')
 const getConstants = require('../../constants').getConstants
 const CONSTANTS = getConstants()
 
@@ -71,7 +71,7 @@ router.get('/registryOrg',
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
   query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
-  // parseError,
+  parseError,
   parseGetParams,
   controller.ALL_ORGS
 )
@@ -141,7 +141,7 @@ router.get('/registryOrg/:identifier',
   mw.validateUser,
   mw.onlySecretariat,
   param(['identifier']).isString().trim(),
-  // parseError,
+  parseError,
   parseGetParams,
   controller.SINGLE_ORG
 )
@@ -214,14 +214,38 @@ router.post('/registryOrg',
   mw.onlySecretariat,
   body(['short_name']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   body(['long_name']).isString().trim().notEmpty(),
+  body(['cve_program_org_function']).isString().trim().default('CNA'),
+  body(['root_or_tlr']).default(false).isBoolean(),
+  body(['oversees']).default([]).isArray(),
+  body(
+    [
+      'charter_or_scope',
+      'disclosure_policy',
+      'product_list',
+      'reports_to',
+      'contact_info.poc',
+      'contact_info.poc_email',
+      'contact_info.poc_phone',
+      'contact_info.org_email',
+      'contact_info.website'
+    ])
+    .default('')
+    .isString(),
   body(['authority.active_roles']).optional()
     .custom(isFlatStringArray)
     .customSanitizer(toUpperCaseArray)
     .custom(isOrgRole),
   body(['soft_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   body(['hard_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
-  // TODO: more validation needed?
-  // parseError,
+  body(['contact_info.additional_contact_users']).optional()
+    .custom(isFlatStringArray),
+  body(['contact_info.admins']).optional()
+    .custom(isFlatStringArray),
+  body(['aliases']).optional()
+    .custom(isFlatStringArray)
+    .customSanitizer(toLowerCaseArray),
+  // TO-DO: validate users here once implemented
+  parseError,
   parsePostParams,
   controller.CREATE_ORG
 )
@@ -307,8 +331,40 @@ router.put('/registryOrg/:shortname',
   mw.validateUser,
   mw.onlySecretariat,
   param(['shortname']).isString().trim(),
-  // TODO: do more validation here
-  // parseError,
+  body(['short_name']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
+  body(['long_name']).isString().trim().notEmpty(),
+  body(['cve_program_org_function']).isString().trim().default('CNA'),
+  body(['root_or_tlr']).default(false).isBoolean(),
+  body(['oversees']).default([]).isArray(),
+  body(
+    [
+      'charter_or_scope',
+      'disclosure_policy',
+      'product_list',
+      'reports_to',
+      'contact_info.poc',
+      'contact_info.poc_email',
+      'contact_info.poc_phone',
+      'contact_info.org_email',
+      'contact_info.website'
+    ])
+    .default('')
+    .isString(),
+  body(['authority.active_roles']).optional()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole),
+  body(['soft_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
+  body(['hard_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
+  body(['contact_info.additional_contact_users']).optional()
+    .custom(isFlatStringArray),
+  body(['contact_info.admins']).optional()
+    .custom(isFlatStringArray),
+  body(['aliases']).optional()
+    .custom(isFlatStringArray)
+    .customSanitizer(toLowerCaseArray),
+  // TO-DO: validate users here once implemented
+  parseError,
   parsePostParams,
   parseGetParams,
   controller.UPDATE_ORG
@@ -380,7 +436,7 @@ router.delete('/registryOrg/:identifier',
   // TODO: permissions
   mw.onlySecretariat,
   param(['identifier']).isString().trim(),
-  // parseError,
+  parseError,
   parseDeleteParams,
   controller.DELETE_ORG
 )

src/controller/registry-org.controller/registry-org.controller.js

@@ -98,7 +98,7 @@ async function createOrg (req, res, next) {
       } else if (k === 'short_name') {
         newOrg.short_name = body[k]
       } else if (k === 'aliases') {
-        newOrg.aliases = [...new Set(body[k].active_roles)]
+        newOrg.aliases = [...new Set(body[k])]
       } else if (k === 'cve_program_org_function') {
         newOrg.cve_program_org_function = body[k]
       } else if (k === 'authority') {

src/middleware/middleware.js

@@ -533,6 +533,27 @@ function toUpperCaseArray (val) {
   return newArr
 }
 
+/**
+ * Recursively casts to strings and lower-cases all items in array
+ *
+ * @param {Array} val
+ */
+function toLowerCaseArray (val) {
+  if (!Array.isArray(val)) {
+    return val.toString().toLowerCase()
+  }
+
+  const newArr = val.map(k => {
+    if (Array.isArray(k)) {
+      return toLowerCaseArray(k)
+    } else {
+      return k.toString().toLowerCase()
+    }
+  })
+
+  return newArr
+}
+
 // Check for the invalid characters <, >, and "
 function containsNoInvalidCharacters (val) {
   const invalidCharacterList = ['<', '>', '"']
@@ -568,6 +589,7 @@ module.exports = {
   isFlatStringArray,
   isCveProgramOrgMembershipObject,
   toUpperCaseArray,
+  toLowerCaseArray,
   containsNoInvalidCharacters,
   trimJSONWhitespace
 }