mirror of
https://github.com/github/codeql.git
synced 2025-12-19 10:23:15 +01:00
22 lines
753 B
Ruby
22 lines
753 B
Ruby
require "excon"
|
|
require "json"
|
|
|
|
class PostsController < ActionController::Base
|
|
def create
|
|
user = params[:user_id]
|
|
|
|
# BAD - user can control the entire URL of the request
|
|
users_service_domain = params[:users_service_domain]
|
|
response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body
|
|
token = JSON.parse(response)["token"]
|
|
|
|
# GOOD - user can only control the suffix of the URL
|
|
users_service_path = params[:users_service_path]
|
|
response = Excon.post("users-service/#{users_service_path}", body: {user_id: user}).body
|
|
token = JSON.parse(response)["token"]
|
|
|
|
@post = Post.create(params[:post].merge(user_token: token))
|
|
render @post
|
|
end
|
|
end
|