Defend against code injection (#30)

Author: mkstix6

app/app.js

@@ -39,11 +39,19 @@ const getPactVersion = (json) => {
     }
 }
 
+function isValidVersion(version) {
+    return /^\d+\.\d+\.\d+$/.test(version);
+}
+
 const getParser = (version) => {
-    try {
-        return require(`./parsers/${version}/pact-parser`);
-    } catch(err) {
-        throw new Error(`Could not find a parser for the pact specification version: ${version}`);
+    if(isValidVersion(version)){
+        try {
+            return require(`./parsers/${version}/pact-parser`);
+        } catch(err) {
+            throw new Error(`Could not find a parser for the pact specification version: ${version}`);
+        }
+    } else {
+        throw new Error(`Invalid pact-parser version supplied: ${version}`);
     }
 }
 

tests/fixtures/invalid-version-pact.json

@@ -0,0 +1,38 @@
+{
+  "consumer": {
+    "name": "consumerName"
+  },
+  "provider": {
+    "name": "providerName"
+  },
+  "interactions": [
+    {
+      "description": "Interaction description",
+      "providerState": "provider state",
+      "request": {
+        "method": "GET",
+        "path": "/path1/path2",
+        "query": "p1=p1&p2=p2",
+        "headers": {
+          "Accept": "application/json"
+        }
+      },
+      "response": {
+        "status": 200,
+        "headers": {
+          "Access-Control-Allow-Methods": "*",
+          "Access-Control-Allow-Origin": "*",
+          "Content-Type": "application/json; charset=UTF-8"
+        },
+        "body": {
+          "data": 1
+        }
+      }
+    }
+  ],
+  "metadata": {
+    "pactSpecification": {
+      "version": "not-a-valid-version-pattern"
+    }
+  }
+}

tests/unit/app/app.js

@@ -118,4 +118,12 @@ describe('pmpact > app', () => {
         }
     });
 
+    it('should throw an error when pact version is of incorrect format', async () => {
+        try {
+            await app.parse('./tests/fixtures/invalid-version-pact.json');
+            assert.ok(0, 'Should not resolve');
+        } catch(err) {
+            assert.ok(err.message.indexOf('Invalid pact-parser version supplied') !== -1);
+        }
+    });
 });