No verification for RouterIPAddress entry
N0ne1eft opened this issue · comments
Y. Zhang commented
The /api/team/create method is allowing any string value for routerIPAddress. Although verification can be added in other micro services before http request being sent I suggest adding database side verification would be better.
No error was reported in the database side log
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (1ms) [Parameters=[@p0='?' (DbType = Int32), @p1='?', @p2='?' (DbType = Int32)], CommandType='Text', CommandTimeout='30']
INSERT INTO "Configs" ("ConnectionType", "RouterIpAddress", "RouterPort")
VALUES (@p0, @p1, @p2)
RETURNING "Id";
Gherman commented
To be fixed