From bdcb856655f3dd1d1314255ddf91c0891d8dbbb3 Mon Sep 17 00:00:00 2001
From: Zaid Abdulla <zaid@genieacs.com>
Date: Wed, 22 Feb 2017 16:50:21 -0800
Subject: [PATCH] Validate scripts before saving

---
 lib/nbi.coffee | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/nbi.coffee b/lib/nbi.coffee
index be8ac6f..258d52c 100644
--- a/lib/nbi.coffee
+++ b/lib/nbi.coffee
@@ -41,6 +41,7 @@
 url = require 'url'
 mongodb = require 'mongodb'
 querystring = require 'querystring'
+vm = require 'vm'
 
 config = require './config'
 common = require './common'
@@ -156,6 +157,12 @@ listener = (request, response) ->
           _id: provisionName
           script: body.toString()
         }
+        try
+          new vm.Script("\"use strict\";(function(){\n#{object.script}\n})();")
+        catch err
+          response.writeHead(400)
+          response.end("#{err.name}: #{err.message}")
+          return
 
         db.provisionsCollection.save(object, (err) ->
           return throwError(err, response) if err
@@ -184,6 +191,12 @@ listener = (request, response) ->
           _id: virtualParameterName
           script: body.toString()
         }
+        try
+          new vm.Script("\"use strict\";(function(){\n#{object.script}\n})();")
+        catch err
+          response.writeHead(400)
+          response.end("#{err.name}: #{err.message}")
+          return
 
         db.virtualParametersCollection.save(object, (err) ->
           return throwError(err, response) if err