Merge branch '8784-dir-listings'

[arvados.git] / services / api / lib / load_param.rb

diff --git a/services/api/lib/load_param.rb b/services/api/lib/load_param.rb
index 3bab33f9a9d90e5da56d206841d8c05052909b85..247708be47812d18907c0c6c6a028e85e3338bb3 100644 (file)
--- a/services/api/lib/load_param.rb
+++ b/services/api/lib/load_param.rb
@@ -1,3 +1,7 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 # Mixin module for reading out query parameters from request params.
 #
 # Expects:
@@ -17,7 +21,7 @@ module LoadParam
       @where = params[:where]
     elsif params[:where].is_a? String
       begin
-        @where = Oj.strict_load(params[:where])
+        @where = SafeJSON.load(params[:where])
         raise unless @where.is_a? Hash
       rescue
         raise ArgumentError.new("Could not parse \"where\" param as an object")
@@ -33,7 +37,7 @@ module LoadParam
       @filters += params[:filters]
     elsif params[:filters].is_a? String and !params[:filters].empty?
       begin
-        f = Oj.strict_load params[:filters]
+        f = SafeJSON.load(params[:filters])
         if not f.nil?
           raise unless f.is_a? Array
           @filters += f
@@ -72,7 +76,7 @@ module LoadParam
       (case params[:order]
        when String
          if params[:order].starts_with? '['
-           od = Oj.strict_load(params[:order])
+           od = SafeJSON.load(params[:order])
            raise unless od.is_a? Array
            od
          else
@@ -142,7 +146,7 @@ module LoadParam
       @select = params[:select]
     when String
       begin
-        @select = Oj.strict_load params[:select]
+        @select = SafeJSON.load(params[:select])
         raise unless @select.is_a? Array or @select.nil?
       rescue
         raise ArgumentError.new("Could not parse \"select\" param as an array")
@@ -153,8 +157,9 @@ module LoadParam
       # Any ordering columns must be selected when doing select,
       # otherwise it is an SQL error, so filter out invaliding orderings.
       @orders.select! { |o|
+        col, _ = o.split
         # match select column against order array entry
-        @select.select { |s| /^#{table_name}.#{s}( (asc|desc))?$/.match o }.any?
+        @select.select { |s| col == "#{table_name}.#{s}" }.any?
       }
     end