Bark beetle report - #10
Conversation
New endpoint to accept bark beetle reports and forward them via PostMark for reviewing
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| const attachments = []; | ||
|
|
||
| for (let i = 0; i < images.length; i++) { |
Check failure
Code scanning / CodeQL
Loop bound injection
|
|
||
| const attachments = []; | ||
|
|
||
| for (let i = 0; i < images.length; i++) { |
Check failure
Code scanning / CodeQL
Type confusion through parameter tampering
vycius
left a comment
vycius
left a comment
There was a problem hiding this comment.
It's relatively easy to abuse this feature and inundate email servers, potentially sending millions of emails through Postmark by making multiple calls to this endpoint. Keep this possibility in mind while implementing and using this feature. Otherwise, the code appears good.
| attachments.push({ | ||
| Name: 'nuotrauka' + i + '.jpg', | ||
| Content: encodedImageContent, | ||
| ContentType: 'image/jpeg', |
There was a problem hiding this comment.
The image won't always be 'image/jpeg'. I would recommended to detect the file type and extension dynamically using a magic number approach. Utilize libraries like file-type (https://www.npmjs.com/package/file-type) or equivalent for detection.
| return this.postmarkService.sendBarkBeetleReport( | ||
| createReportDto, | ||
| images, | ||
| 'benas.svedas@aad.am.lt', |
There was a problem hiding this comment.
I would recommend to move email to environment variables.
| sendBarkBeetleReport( | ||
| @Body() createReportDto: CreateReportDto, | ||
| @UploadedFiles() images: Array<Express.Multer.File>, | ||
| ): Promise<MessageSendingResponse> { |
There was a problem hiding this comment.
Not sure if it's really good to return such response to public. It might contain some confidential information.
3 participants
Add endpoint to send bark beetle reports. No need to save them. They are only sent out for manual tracking via PostMark automatic emails.