bugfixes

bizmatch-server/src/listings/business-listing.service.ts

@@ -10,7 +10,7 @@ import { GeoService } from '../geo/geo.service';
 import { BusinessListing, BusinessListingSchema } from '../models/db.model';
 import { BusinessListingCriteria, JwtUser } from '../models/main.model';
 import { getDistanceQuery, splitName } from '../utils';
-import { generateSlug, extractShortIdFromSlug, isSlug } from '../utils/slug.utils';
+import { generateSlug, extractShortIdFromSlug, isSlug, isUUID } from '../utils/slug.utils';
 
 @Injectable()
 export class BusinessListingService {
@@ -271,6 +271,9 @@ export class BusinessListingService {
       }
     } else {
       this.logger.debug(`Detected as UUID: ${slugOrId}`);
+      if (!isUUID(slugOrId)) {
+        throw new BadRequestException(`Invalid identifier format: ${slugOrId}`);
+      }
     }
 
     return this.findBusinessesById(id, user);

bizmatch-server/src/listings/commercial-property.service.ts

@@ -11,7 +11,7 @@ import { GeoService } from '../geo/geo.service';
 import { CommercialPropertyListing, CommercialPropertyListingSchema } from '../models/db.model';
 import { CommercialPropertyListingCriteria, JwtUser } from '../models/main.model';
 import { getDistanceQuery, splitName } from '../utils';
-import { generateSlug, extractShortIdFromSlug, isSlug } from '../utils/slug.utils';
+import { generateSlug, extractShortIdFromSlug, isSlug, isUUID } from '../utils/slug.utils';
 
 @Injectable()
 export class CommercialPropertyService {
@@ -166,6 +166,9 @@ export class CommercialPropertyService {
       }
     } else {
       this.logger.debug(`Detected as UUID: ${slugOrId}`);
+      if (!isUUID(slugOrId)) {
+        throw new BadRequestException(`Invalid identifier format: ${slugOrId}`);
+      }
     }
 
     return this.findCommercialPropertiesById(id, user);

bizmatch-server/src/listings/unknown-listings.controller.ts

@@ -1,9 +1,10 @@
-import { Controller, Get, Inject, Param, Request, UseGuards } from '@nestjs/common';
+import { Controller, Get, Inject, Param, Request, UseGuards, BadRequestException } from '@nestjs/common';
 import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
 import { OptionalAuthGuard } from 'src/jwt-auth/optional-auth.guard';
 import { Logger } from 'winston';
 import { BusinessListingService } from './business-listing.service';
 import { CommercialPropertyService } from './commercial-property.service';
+import { isUUID } from '../utils/slug.utils';
 
 @Controller('listings/undefined')
 export class UnknownListingsController {
@@ -16,6 +17,9 @@ export class UnknownListingsController {
   @UseGuards(OptionalAuthGuard)
   @Get(':id')
   async findById(@Request() req, @Param('id') id: string): Promise<any> {
+    if (!isUUID(id)) {
+      throw new BadRequestException(`Invalid identifier format: ${id}`);
+    }
     try {
       return await this.businessListingsService.findBusinessesById(id, req.user);
     } catch (error) {

bizmatch-server/src/utils/slug.utils.ts

@@ -107,6 +107,13 @@ export function isValidSlug(slug: string): boolean {
   return lastPart.length === 8 && /^[a-z0-9]{8}$/.test(lastPart);
 }
 
+/**
+ * Check if a string is a valid UUID v4
+ */
+export function isUUID(param: string): boolean {
+  return /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(param);
+}
+
 /**
  * Check if a parameter is a slug (vs a UUID)
  *