Files
Trần Bách 986c4cae6c fix(security): undefined variable next referenced in route erro
The GET /schema route handler's function signature is `(req, res)` (only two parameters), but the catch block calls `next(err)`. Since `next` is not defined in this scope, this will throw a `ReferenceError` at runtime when an error occurs, potentially crashing the process or causing an unhandled rejection instead of properly returning an error response.

Affected files: schema.js

Signed-off-by: Trần Bách <45133811+barttran2k@users.noreply.github.com>
2026-04-07 00:09:34 +07:00

45 lines
1.1 KiB
JavaScript

import express from "express";
import { debug, express as logger } from "../logger.js";
import PACKAGE from "../package.json" with { type: "json" };
import { getCompiledSchema } from "../schema/index.js";
const router = express.Router({
caseSensitive: true,
strict: true,
mergeParams: true,
});
router
.route("/")
.options((_, res) => {
res.sendStatus(204);
})
/**
* GET /schema
*/
.get(async (req, res, next) => {
try {
const swaggerJSON = await getCompiledSchema();
let proto = req.protocol;
if (typeof req.headers["x-forwarded-proto"] !== "undefined" && req.headers["x-forwarded-proto"]) {
proto = req.headers["x-forwarded-proto"];
}
let origin = `${proto}://${req.hostname}`;
if (typeof req.headers.origin !== "undefined" && req.headers.origin) {
origin = req.headers.origin;
}
swaggerJSON.info.version = PACKAGE.version;
swaggerJSON.servers[0].url = `${origin}/api`;
res.status(200).send(swaggerJSON);
} catch (err) {
debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
next(err);
}
});
export default router;