fix(chat): add validation (#2866)

Co-authored-by: Ilya Bondar <[email protected]>

apps/chat/src/pages/api/[entitytype]/[...slug].ts

@@ -4,11 +4,11 @@ import { JWT, getToken } from 'next-auth/jwt';
 
 import { constructPath } from '@/src/utils/app/file';
 import { validateServerSession } from '@/src/utils/auth/session';
+import { isValidEntityApiType } from '@/src/utils/server/api';
 import { getApiHeaders } from '@/src/utils/server/get-headers';
 import { logger } from '@/src/utils/server/logger';
 import { ServerUtils } from '@/src/utils/server/server';
 
-import { ApiKeys } from '@/src/types/common';
 import { DialAIError } from '@/src/types/error';
 import { HTTPMethod } from '@/src/types/http';
 
@@ -40,10 +40,6 @@ const getEntityUrlFromSlugs = (
   );
 };
 
-const isValidEntityApiType = (apiKey: string): boolean => {
-  return Object.values(ApiKeys).includes(apiKey as ApiKeys);
-};
-
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
   const entityType = ServerUtils.getEntityTypeFromPath(req);
   if (!entityType || !isValidEntityApiType(entityType)) {

apps/chat/src/pages/api/listing/multiple.ts

@@ -4,6 +4,7 @@ import { getServerSession } from 'next-auth/next';
 
 import { constructPath } from '@/src/utils/app/file';
 import { validateServerSession } from '@/src/utils/auth/session';
+import { isValidEntityApiType } from '@/src/utils/server/api';
 import { getApiHeaders } from '@/src/utils/server/get-headers';
 import { logger } from '@/src/utils/server/logger';
 
@@ -15,6 +16,7 @@ import { errorsMessages } from '@/src/constants/errors';
 
 import { authOptions } from '@/src/pages/api/auth/[...nextauth]';
 
+import { sanitizeUri } from 'micromark-util-sanitize-uri';
 import fetch from 'node-fetch';
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
@@ -37,14 +39,19 @@ const handler = async (req: NextApiRequest, res: NextApiResponse) => {
     };
     const token = await getToken({ req });
 
-    const apiUrls = body.urls.map(
-      (url) =>
-        `${constructPath(
-          process.env.DIAL_API_HOST,
-          'v1/metadata',
-          url,
-        )}/?limit=${limit}&recursive=${recursive}`,
-    );
+    const apiUrls = body.urls
+      .map((url) => {
+        const entityType = url.split('/')[0];
+        if (isValidEntityApiType(entityType)) {
+          return `${constructPath(
+            process.env.DIAL_API_HOST,
+            'v1/metadata',
+            sanitizeUri(url),
+          )}/?limit=${limit}&recursive=${recursive}`;
+        }
+        return;
+      })
+      .filter(Boolean) as string[];
 
     const fetchPromises = apiUrls.map(async (url) => {
       const response = await fetch(url, {

apps/chat/src/pages/api/publication/[entitytype]/[...slug].ts

@@ -4,11 +4,11 @@ import { getToken } from 'next-auth/jwt';
 
 import { constructPath } from '@/src/utils/app/file';
 import { validateServerSession } from '@/src/utils/auth/session';
+import { isValidEntityApiType } from '@/src/utils/server/api';
 import { getApiHeaders } from '@/src/utils/server/get-headers';
 import { logger } from '@/src/utils/server/logger';
 import { ServerUtils } from '@/src/utils/server/server';
 
-import { ApiKeys } from '@/src/types/common';
 import { DialAIError } from '@/src/types/error';
 
 import { errorsMessages } from '@/src/constants/errors';
@@ -39,10 +39,6 @@ const getEntityUrlFromSlugs = (
   );
 };
 
-const isValidEntityApiType = (apiKey: string): boolean => {
-  return Object.values(ApiKeys).includes(apiKey as ApiKeys);
-};
-
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
   const entityType = ServerUtils.getEntityTypeFromPath(req);
   if (!entityType || !isValidEntityApiType(entityType)) {

apps/chat/src/utils/server/api.ts

@@ -5,6 +5,7 @@ import { ServerUtils } from '@/src/utils/server/server';
 
 import { ApplicationInfo } from '@/src/types/applications';
 import { Conversation } from '@/src/types/chat';
+import { ApiKeys } from '@/src/types/common';
 import { HTTPMethod } from '@/src/types/http';
 import { PromptInfo } from '@/src/types/prompt';
 
@@ -283,3 +284,7 @@ export const getPublicItemIdWithoutVersion = (version: string, id: string) => {
 
 export const addVersionToId = (id: string, version: string) =>
   [id, version].join(pathKeySeparator);
+
+export const isValidEntityApiType = (apiKey: string): boolean => {
+  return Object.values(ApiKeys).includes(apiKey as ApiKeys);
+};