fix: visibilityInt value check (#1429)

bnb-chain · Jul 5, 2024 · d939fcf · d939fcf
1 parent c7a88d1
commit d939fcf
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/modular/gater/object_handler.go b/modular/gater/object_handler.go
@@ -1166,6 +1166,10 @@ func (g *GateModular) delegatePutObjectHandler(w http.ResponseWriter, r *http.Re
 			if err != nil {
 				return
 			}
+			if visibilityInt < 0 || visibilityInt >= int64(len(storagetypes.VisibilityType_value)) {
+				err = ErrInvalidQuery
+				return
+			}
 			visibility = storagetypes.VisibilityType(visibilityInt)
 			if visibility == storagetypes.VISIBILITY_TYPE_UNSPECIFIED {
 				visibility = storagetypes.VISIBILITY_TYPE_INHERIT // set default visibility type
@@ -1391,6 +1395,10 @@ func (g *GateModular) delegateResumablePutObjectHandler(w http.ResponseWriter, r
 		if err != nil {
 			return
 		}
+		if visibilityInt < 0 || visibilityInt >= int64(len(storagetypes.VisibilityType_value)) {
+			err = ErrInvalidQuery
+			return
+		}
 		visibility = storagetypes.VisibilityType(visibilityInt)
 		if visibility == storagetypes.VISIBILITY_TYPE_UNSPECIFIED {
 			visibility = storagetypes.VISIBILITY_TYPE_INHERIT // set default visibility type
@@ -1617,6 +1625,10 @@ func (g *GateModular) delegateCreateFolderHandler(w http.ResponseWriter, r *http
 		if err != nil {
 			return
 		}
+		if visibilityInt < 0 || visibilityInt >= int64(len(storagetypes.VisibilityType_value)) {
+			err = ErrInvalidQuery
+			return
+		}
 		visibility = storagetypes.VisibilityType(visibilityInt)
 		if visibility == storagetypes.VISIBILITY_TYPE_UNSPECIFIED {
 			visibility = storagetypes.VISIBILITY_TYPE_INHERIT // set default visibility type