From 83de65f913b8d8f194c6f70765cb68bf75bf9257 Mon Sep 17 00:00:00 2001
From: Shweelan Samson <shweelan@genieacs.com>
Date: Fri, 19 Apr 2019 19:20:17 +0300
Subject: [PATCH] Prevent invalid scripts in provisions and vparams

---
 lib/ui/db.ts | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/ui/db.ts b/lib/ui/db.ts
index d5c3560..b4ea264 100644
--- a/lib/ui/db.ts
+++ b/lib/ui/db.ts
@@ -1,4 +1,5 @@
 import { MongoClient, GridFSBucket } from "mongodb";
+import { Script } from "vm";
 import * as config from "../config";
 import * as mongodbFunctions from "../mongodb-functions";
 import * as expression from "../common/expression";
@@ -272,6 +273,12 @@ export function deletePreset(id): Promise<void> {
 }
 
 export function putProvision(id, object): Promise<void> {
+  if (!object.script) object.script = "";
+  try {
+    new Script(`"use strict";(function(){\n${object.script}\n})();`);
+  } catch (error) {
+    return Promise.reject(error);
+  }
   return putResource("provisions", id, object);
 }
 
@@ -280,6 +287,12 @@ export function deleteProvision(id): Promise<void> {
 }
 
 export function putVirtualParameter(id, object): Promise<void> {
+  if (!object.script) object.script = "";
+  try {
+    new Script(`"use strict";(function(){\n${object.script}\n})();`);
+  } catch (error) {
+    return Promise.reject(error);
+  }
   return putResource("virtualParameters", id, object);
 }