Merge faea05e712 into de975a5991

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Hardened the validation of the countries in the asset profile endpoints
 - Set the change detection strategy to `OnPush` in the _X-ray_ page
 
 ## 3.25.0 - 2026-07-12

libs/common/src/lib/dtos/country.dto.ts

@@ -0,0 +1,11 @@
+import { IsISO31661Alpha2, IsNumber, Max, Min } from 'class-validator';
+
+export class CountryDto {
+  @IsISO31661Alpha2()
+  code: string;
+
+  @IsNumber()
+  @Min(0)
+  @Max(1)
+  weight: number;
+}

libs/common/src/lib/dtos/create-asset-profile.dto.ts

@@ -1,15 +1,19 @@
 import { IsCurrencyCode } from '@ghostfolio/common/validators/is-currency-code';
 
 import { AssetClass, AssetSubClass, DataSource, Prisma } from '@prisma/client';
+import { Type } from 'class-transformer';
 import {
   IsArray,
   IsBoolean,
   IsEnum,
   IsOptional,
   IsString,
-  IsUrl
+  IsUrl,
+  ValidateNested
 } from 'class-validator';
 
+import { CountryDto } from './country.dto';
+
 export class CreateAssetProfileDto {
   @IsEnum(AssetClass)
   @IsOptional()
@@ -25,6 +29,8 @@ export class CreateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => CountryDto)
+  @ValidateNested({ each: true })
   countries?: Prisma.InputJsonArray;
 
   @IsCurrencyCode()

libs/common/src/lib/dtos/index.ts

@@ -1,4 +1,5 @@
 import { AuthDeviceDto } from './auth-device.dto';
+import { CountryDto } from './country.dto';
 import { CreateAccessDto } from './create-access.dto';
 import { CreateAccountBalanceDto } from './create-account-balance.dto';
 import { CreateAccountWithBalancesDto } from './create-account-with-balances.dto';
@@ -26,6 +27,7 @@ import { UpdateUserSettingDto } from './update-user-setting.dto';
 
 export {
   AuthDeviceDto,
+  CountryDto,
   CreateAccessDto,
   CreateAccountBalanceDto,
   CreateAccountDto,

libs/common/src/lib/dtos/update-asset-profile.dto.ts

@@ -7,6 +7,7 @@ import {
   DataSource,
   Prisma
 } from '@prisma/client';
+import { Type } from 'class-transformer';
 import {
   IsArray,
   IsBoolean,
@@ -14,9 +15,12 @@ import {
   IsObject,
   IsOptional,
   IsString,
-  IsUrl
+  IsUrl,
+  ValidateNested
 } from 'class-validator';
 
+import { CountryDto } from './country.dto';
+
 export class UpdateAssetProfileDto {
   @IsEnum(AssetClass)
   @IsOptional()
@@ -32,6 +36,8 @@ export class UpdateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => CountryDto)
+  @ValidateNested({ each: true })
   countries?: Prisma.InputJsonArray;
 
   @IsCurrencyCode()