@centreon/js-config 26.7.9 → 26.7.10

package/cypress/component/configuration.js

@@ -63,8 +63,14 @@ module.exports = ({
           }
 
           // Save the testRetries object to a file in the e2e/results directory
+          const projectRoot = path.resolve(process.cwd());
+          const resolvedFolder = path.resolve(mainCypressFolder);
+          if (resolvedFolder !== projectRoot && !resolvedFolder.startsWith(projectRoot + path.sep)) {
+            throw new Error('mainCypressFolder is outside of the project directory');
+          }
+
           const resultFilePath = path.join(
-            mainCypressFolder,
+            resolvedFolder,
             'results',
             'retries.json'
           );

package/cypress/e2e/commands/monitoring.ts

@@ -32,12 +32,11 @@ Cypress.Commands.add(
     host,
     isForced = true
   }: ServiceCheck): Cypress.Chainable => {
-    let query = `SELECT id FROM resources WHERE name = '${host}' AND type = 1`;
-
     return cy
       .requestOnDatabase({
         database: 'centreon_storage',
-        query
+        query: 'SELECT id FROM resources WHERE name = ? AND type = 1',
+        params: [host]
       })
       .then(([rows]) => {
         if (rows.length === 0) {
@@ -84,12 +83,11 @@ Cypress.Commands.add(
     isForced = true,
     service
   }: ServiceCheck): Cypress.Chainable => {
-    let query = `SELECT parent_id, id FROM resources WHERE parent_name = '${host}' AND name = '${service}'`;
-
     return cy
       .requestOnDatabase({
         database: 'centreon_storage',
-        query
+        query: 'SELECT parent_id, id FROM resources WHERE parent_name = ? AND name = ?',
+        params: [host, service]
       })
       .then(([rows]) => {
         if (rows.length === 0) {
@@ -181,22 +179,23 @@ Cypress.Commands.add(
     cy.log('Checking hosts in database');
 
     let query = `SELECT COUNT(d.downtime_id) AS count_downtimes FROM downtimes as d
-      INNER JOIN hosts as h ON h.host_id = d.host_id AND h.name = '${downtime.host}'`;
+      INNER JOIN hosts as h ON h.host_id = d.host_id AND h.name = ?`;
+    const params: Array<string> = [downtime.host];
     if (downtime.service) {
-      query += ` INNER JOIN services as s ON s.service_id = d.service_id AND s.description = '${downtime.service}'`;
+      query += ` INNER JOIN services as s ON s.service_id = d.service_id AND s.description = ?`;
+      params.push(downtime.service);
     }
     query += ` WHERE d.started=1`;
     if (!downtime.service) {
       query += ` AND d.service_id = 0`;
     }
 
-    cy.log(query);
-
     cy.waitUntil(() => {
       return cy
         .requestOnDatabase({
           database: 'centreon_storage',
-          query
+          query,
+          params
         })
         .then(([rows]) => {
           const foundDowntimesCount = rows.length ? rows[0].count_downtimes : 0;

package/cypress/e2e/commands.ts

@@ -459,13 +459,14 @@ Output:\n${displayedOutput}`);
 
 interface RequestOnDatabaseProps {
   database: string;
+  params?: Array<string | number>;
   query: string;
 }
 
 Cypress.Commands.add(
   'requestOnDatabase',
-  ({ database, query }: RequestOnDatabaseProps): Cypress.Chainable => {
-    return cy.task('requestOnDatabase', { database, query });
+  ({ database, query, params }: RequestOnDatabaseProps): Cypress.Chainable => {
+    return cy.task('requestOnDatabase', { database, query, params });
   }
 );
 
@@ -1046,7 +1047,8 @@ declare global {
       }: NavigateToProps) => Cypress.Chainable;
       requestOnDatabase: ({
         database,
-        query
+        query,
+        params
       }: RequestOnDatabaseProps) => Cypress.Chainable;
       setUserTokenApiV1: ({
         login,

package/cypress/e2e/tasks.ts

@@ -155,7 +155,7 @@ export default (on: Cypress.PluginEvents): void => {
 
       return container.getMappedPort(containerPort);
     },
-    requestOnDatabase: async ({ database, query }) => {
+    requestOnDatabase: async ({ database, query, params }) => {
       let container: StartedTestContainer | null = null;
 
       if (dockerEnvironment !== null) {
@@ -172,11 +172,15 @@ export default (on: Cypress.PluginEvents): void => {
         user: "centreon",
       });
 
-      const [rows, fields] = await client.query(query);
-
-      await client.end();
+      try {
+        const [rows, fields] = params
+          ? await client.execute(query, params)
+          : await client.query(query);
 
-      return [rows, fields];
+        return [rows, fields];
+      } finally {
+        await client.end();
+      }
     },
     startContainer: async ({
       command,
@@ -308,21 +312,36 @@ export default (on: Cypress.PluginEvents): void => {
       return path.join(downloadsFolder, files[0].name);
     },
     readCsvFile({ filePath }: { filePath: string }): Promise<string> {
+      const projectRoot = path.resolve(process.cwd());
+      const resolvedPath = path.resolve(filePath);
+      if (resolvedPath !== projectRoot && !resolvedPath.startsWith(projectRoot + path.sep)) {
+        return Promise.reject(new Error("Path is outside of the project directory"));
+      }
+
       return new Promise((resolve, reject) => {
-        fs.readFile(filePath, "utf8", (err, data) => {
+        fs.readFile(resolvedPath, "utf8", (err, data) => {
           if (err) return reject(err);
           resolve(data);
         });
       });
     },
     clearDownloadsFolder({ downloadsFolder }: { downloadsFolder: string }): null {
-      if (!fs.existsSync(downloadsFolder)) {
+      const projectRoot = path.resolve(process.cwd());
+      const resolvedFolder = path.resolve(downloadsFolder);
+      if (resolvedFolder !== projectRoot && !resolvedFolder.startsWith(projectRoot + path.sep)) {
+        throw new Error("Path is outside of the project directory");
+      }
+
+      if (!fs.existsSync(resolvedFolder)) {
         return null;
       }
 
-      const files = fs.readdirSync(downloadsFolder);
+      const files = fs.readdirSync(resolvedFolder);
       for (const file of files) {
-        const filePath = path.join(downloadsFolder, file);
+        const filePath = path.join(resolvedFolder, file);
+        if (!filePath.startsWith(resolvedFolder + path.sep)) {
+          continue;
+        }
         fs.unlinkSync(filePath);
       }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@centreon/js-config",
   "description": "Centreon Frontend shared build configuration",
-  "version": "26.7.9",
+  "version": "26.7.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/centreon/centreon.git"