refactor: fix credo issues
All checks were successful
continuous-integration/drone/push Build is passing
All checks were successful
continuous-integration/drone/push Build is passing
This commit is contained in:
parent
01dea8bb8b
commit
fbf3b64192
2 changed files with 74 additions and 28 deletions
|
|
@ -1194,32 +1194,13 @@ defmodule MvWeb.MemberLive.Index do
|
|||
params
|
||||
|> Enum.filter(fn {key, _value} -> String.starts_with?(key, @boolean_filter_prefix) end)
|
||||
|> Enum.reduce(%{}, fn {key, value_str}, acc ->
|
||||
# Extract custom field ID from parameter name (explicitly remove prefix)
|
||||
# This is more secure than String.replace_prefix which only removes first occurrence
|
||||
custom_field_id_str = String.slice(key, prefix_length, String.length(key) - prefix_length)
|
||||
|
||||
# Validate custom field ID length (UUIDs are max @max_uuid_length characters)
|
||||
# This provides an additional security layer beyond UUID format validation
|
||||
if String.length(custom_field_id_str) <= @max_uuid_length do
|
||||
# Validate custom field ID exists and is boolean type
|
||||
case Ecto.UUID.cast(custom_field_id_str) do
|
||||
{:ok, _custom_field_id} ->
|
||||
if Map.has_key?(boolean_custom_fields, custom_field_id_str) do
|
||||
# Validate filter value
|
||||
case determine_boolean_filter(value_str) do
|
||||
nil -> acc
|
||||
filter_value -> Map.put(acc, custom_field_id_str, filter_value)
|
||||
end
|
||||
else
|
||||
acc
|
||||
end
|
||||
|
||||
:error ->
|
||||
acc
|
||||
end
|
||||
else
|
||||
process_boolean_filter_param(
|
||||
key,
|
||||
value_str,
|
||||
prefix_length,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
end
|
||||
)
|
||||
end)
|
||||
|
||||
# Security: Limit number of filters to prevent DoS attacks
|
||||
|
|
@ -1240,6 +1221,73 @@ defmodule MvWeb.MemberLive.Index do
|
|||
assign(socket, :boolean_custom_field_filters, filters)
|
||||
end
|
||||
|
||||
# Processes a single boolean filter parameter from URL params.
|
||||
#
|
||||
# Validates the parameter and adds it to the accumulator if valid.
|
||||
# Returns the accumulator unchanged if validation fails.
|
||||
defp process_boolean_filter_param(
|
||||
key,
|
||||
value_str,
|
||||
prefix_length,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
) do
|
||||
# Extract custom field ID from parameter name (explicitly remove prefix)
|
||||
# This is more secure than String.replace_prefix which only removes first occurrence
|
||||
custom_field_id_str = String.slice(key, prefix_length, String.length(key) - prefix_length)
|
||||
|
||||
# Validate custom field ID length (UUIDs are max @max_uuid_length characters)
|
||||
# This provides an additional security layer beyond UUID format validation
|
||||
if String.length(custom_field_id_str) > @max_uuid_length do
|
||||
acc
|
||||
else
|
||||
validate_and_add_boolean_filter(
|
||||
custom_field_id_str,
|
||||
value_str,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
)
|
||||
end
|
||||
end
|
||||
|
||||
# Validates UUID format and custom field existence, then adds filter if valid.
|
||||
defp validate_and_add_boolean_filter(
|
||||
custom_field_id_str,
|
||||
value_str,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
) do
|
||||
case Ecto.UUID.cast(custom_field_id_str) do
|
||||
{:ok, _custom_field_id} ->
|
||||
add_boolean_filter_if_valid(
|
||||
custom_field_id_str,
|
||||
value_str,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
)
|
||||
|
||||
:error ->
|
||||
acc
|
||||
end
|
||||
end
|
||||
|
||||
# Adds boolean filter to accumulator if custom field exists and value is valid.
|
||||
defp add_boolean_filter_if_valid(
|
||||
custom_field_id_str,
|
||||
value_str,
|
||||
boolean_custom_fields,
|
||||
acc
|
||||
) do
|
||||
if Map.has_key?(boolean_custom_fields, custom_field_id_str) do
|
||||
case determine_boolean_filter(value_str) do
|
||||
nil -> acc
|
||||
filter_value -> Map.put(acc, custom_field_id_str, filter_value)
|
||||
end
|
||||
else
|
||||
acc
|
||||
end
|
||||
end
|
||||
|
||||
# Determines valid boolean filter value from URL parameter.
|
||||
#
|
||||
# SECURITY: This function whitelists allowed filter values. Only "true" and "false"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue