Task/validate property key in admin settings endpoint (#7247)

* Validate property key

* Update changelog

CHANGELOG.md

@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Set the change detection strategy to `OnPush` in the activities page
 - Set the change detection strategy to `OnPush` in the _FIRE_ page
 - Set the change detection strategy to `OnPush` in the users section of the admin control panel
+- Hardened the endpoint to update a property of the admin control panel by validating the `key` path parameter
 - Renamed the `SymbolProfileOverrides` _Prisma_ data model to `AssetProfileOverrides` while keeping the database table name
 - Improved the language localization for Dutch (`nl`)
 - Improved the language localization for French (`fr`)

apps/api/src/app/admin/admin.controller.ts

@@ -29,7 +29,11 @@ import {
   ScraperConfiguration
 } from '@ghostfolio/common/interfaces';
 import { permissions } from '@ghostfolio/common/permissions';
-import type { DateRange, RequestWithUser } from '@ghostfolio/common/types';
+import type {
+  DateRange,
+  PropertyKey,
+  RequestWithUser
+} from '@ghostfolio/common/types';
 
 import {
   Body,
@@ -55,6 +59,7 @@ import { isDate, parseISO } from 'date-fns';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
 
 import { AdminService } from './admin.service';
+import { PropertyKeyPipe } from './pipes/property-key.pipe';
 
 @Controller('admin')
 export class AdminController {
@@ -310,7 +315,7 @@ export class AdminController {
   @Put('settings/:key')
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   public async updateProperty(
-    @Param('key') key: string,
+    @Param('key', PropertyKeyPipe) key: PropertyKey,
     @Body() data: UpdatePropertyDto
   ) {
     return this.adminService.putSetting(key, data.value);

apps/api/src/app/admin/admin.service.ts

@@ -344,17 +344,17 @@ export class AdminService {
     }
   }
 
-  public async putSetting(key: string, value: string) {
+  public async putSetting(key: PropertyKey, value: string) {
     let response: Property;
 
     if (value) {
       response = await this.propertyService.put({
-        value,
-        key: key as PropertyKey
+        key,
+        value
       });
     } else {
       response = await this.propertyService.delete({
-        key: key as PropertyKey
+        key
       });
     }
 

apps/api/src/app/admin/pipes/property-key.pipe.ts

@@ -0,0 +1,29 @@
+import * as config from '@ghostfolio/common/config';
+import type { PropertyKey } from '@ghostfolio/common/types';
+
+import { BadRequestException, Injectable, PipeTransform } from '@nestjs/common';
+
+@Injectable()
+export class PropertyKeyPipe implements PipeTransform<string, PropertyKey> {
+  private readonly allowedKeys: Set<string>;
+
+  public constructor() {
+    this.allowedKeys = new Set<string>(
+      Object.entries(config)
+        .filter(([key]) => {
+          return key.startsWith('PROPERTY_');
+        })
+        .map(([, value]) => {
+          return value as string;
+        })
+    );
+  }
+
+  public transform(value: string): PropertyKey {
+    if (!this.allowedKeys.has(value)) {
+      throw new BadRequestException(`Invalid property key: ${value}`);
+    }
+
+    return value as PropertyKey;
+  }
+}