From d5c591317bb970c3808020032a3c7d37be58a15f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Mon, 16 Apr 2018 18:55:42 +0200
Subject: [PATCH 1/8] Add coordinates validation to specific endpoints

---
 lib/cartodb/controllers/layergroup/static.js  |   2 +
 lib/cartodb/controllers/layergroup/tile.js    |   4 +
 lib/cartodb/controllers/named_maps.js         |   2 +
 lib/cartodb/middleware/coordinates.js         |  32 +++
 test/support/test-client.js                   |   4 +-
 .../cartodb/middlewares/coordinates.test.js   | 215 ++++++++++++++++++
 6 files changed, 257 insertions(+), 2 deletions(-)
 create mode 100644 lib/cartodb/middleware/coordinates.js
 create mode 100644 test/unit/cartodb/middlewares/coordinates.test.js

diff --git a/lib/cartodb/controllers/layergroup/static.js b/lib/cartodb/controllers/layergroup/static.js
index 00510780..1aa9cdeb 100644
--- a/lib/cartodb/controllers/layergroup/static.js
+++ b/lib/cartodb/controllers/layergroup/static.js
@@ -1,6 +1,7 @@
 const cors = require('../../middleware/cors');
 const user = require('../../middleware/user');
 const layergroupToken = require('../../middleware/layergroup-token');
+const coordinates = require('../../middleware/coordinates');
 const cleanUpQueryParams = require('../../middleware/clean-up-query-params');
 const credentials = require('../../middleware/credentials');
 const dbConnSetup = require('../../middleware/db-conn-setup');
@@ -43,6 +44,7 @@ module.exports = class StaticController {
             cors(),
             user(),
             layergroupToken(),
+            coordinates({ z: true, x: false, y: false }),
             credentials(),
             authorize(this.authApi),
             dbConnSetup(this.pgConnection),
diff --git a/lib/cartodb/controllers/layergroup/tile.js b/lib/cartodb/controllers/layergroup/tile.js
index 07727236..544c12b2 100644
--- a/lib/cartodb/controllers/layergroup/tile.js
+++ b/lib/cartodb/controllers/layergroup/tile.js
@@ -1,6 +1,7 @@
 const cors = require('../../middleware/cors');
 const user = require('../../middleware/user');
 const layergroupToken = require('../../middleware/layergroup-token');
+const coordinates = require('../../middleware/coordinates');
 const cleanUpQueryParams = require('../../middleware/clean-up-query-params');
 const credentials = require('../../middleware/credentials');
 const dbConnSetup = require('../../middleware/db-conn-setup');
@@ -51,6 +52,7 @@ module.exports = class TileController {
             cors(),
             user(),
             layergroupToken(),
+            coordinates(),
             credentials(),
             authorize(this.authApi),
             dbConnSetup(this.pgConnection),
@@ -79,6 +81,7 @@ module.exports = class TileController {
             cors(),
             user(),
             layergroupToken(),
+            coordinates(),
             credentials(),
             authorize(this.authApi),
             dbConnSetup(this.pgConnection),
@@ -108,6 +111,7 @@ module.exports = class TileController {
             cors(),
             user(),
             layergroupToken(),
+            coordinates(),
             credentials(),
             authorize(this.authApi),
             dbConnSetup(this.pgConnection),
diff --git a/lib/cartodb/controllers/named_maps.js b/lib/cartodb/controllers/named_maps.js
index 93e56bbe..c9656de0 100644
--- a/lib/cartodb/controllers/named_maps.js
+++ b/lib/cartodb/controllers/named_maps.js
@@ -1,6 +1,7 @@
 const cors = require('../middleware/cors');
 const user = require('../middleware/user');
 const cleanUpQueryParams = require('../middleware/clean-up-query-params');
+const coordinates = require('../middleware/coordinates');
 const credentials = require('../middleware/credentials');
 const dbConnSetup = require('../middleware/db-conn-setup');
 const authorize = require('../middleware/authorize');
@@ -56,6 +57,7 @@ NamedMapsController.prototype.register = function(app) {
         `${templateBasePath}/:template_id/:layer/:z/:x/:y.(:format)`,
         cors(),
         user(),
+        coordinates(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
diff --git a/lib/cartodb/middleware/coordinates.js b/lib/cartodb/middleware/coordinates.js
new file mode 100644
index 00000000..d02b5624
--- /dev/null
+++ b/lib/cartodb/middleware/coordinates.js
@@ -0,0 +1,32 @@
+module.exports = function coordinates (validate = { z: true, x: true, y: true }) {
+    const positiveIntegerNumber = /^\d+$/;
+    const integerNumber = /^-?\d+$/;
+
+    return function coordinatesMiddleware (req, res, next) {
+        const { z, x, y } = req.params;
+
+        if (validate.z && !positiveIntegerNumber.test(z)) {
+            const err = new Error(`Invalid zoom value (${z}). It should be a positive number`);
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        // Negatives values for x param are valid. The x param is wrapped
+        if (validate.x && !integerNumber.test(x)) {
+            const err = new Error(`Invalid coodinate 'x' value (${x}). It should be a number`);
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        if (validate.y && !positiveIntegerNumber.test(y)) {
+            const err = new Error(`Invalid coodinate 'y' value (${y}). It should be a positive number`);
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        next();
+    };
+};
diff --git a/test/support/test-client.js b/test/support/test-client.js
index ea3305fd..5e08394a 100644
--- a/test/support/test-client.js
+++ b/test/support/test-client.js
@@ -905,7 +905,7 @@ TestClient.prototype.getLayergroup = function (params, callback) {
 TestClient.prototype.getStaticCenter = function (params, callback) {
     var self = this;
 
-    let { layergroupid, z, lat, lng, width, height, format } = params;
+    let { layergroupid, zoom, lat, lng, width, height, format } = params;
 
     var url = `/api/v1/map/`;
 
@@ -954,7 +954,7 @@ TestClient.prototype.getStaticCenter = function (params, callback) {
             self.keysToDelete['map_cfg|' + LayergroupToken.parse(layergroupId).token] = 0;
             self.keysToDelete['user:localhost:mapviews:global'] = 5;
 
-            url = `/api/v1/map/static/center/${layergroupId}/${z}/${lat}/${lng}/${width}/${height}.${format}`;
+            url = `/api/v1/map/static/center/${layergroupId}/${zoom}/${lat}/${lng}/${width}/${height}.${format}`;
 
             if (self.apiKey) {
                 url += '?' + qs.stringify({api_key: self.apiKey});
diff --git a/test/unit/cartodb/middlewares/coordinates.test.js b/test/unit/cartodb/middlewares/coordinates.test.js
new file mode 100644
index 00000000..cd1d022e
--- /dev/null
+++ b/test/unit/cartodb/middlewares/coordinates.test.js
@@ -0,0 +1,215 @@
+const assert = require('assert');
+const coordinates = require('../../../../lib/cartodb/middleware/coordinates');
+
+describe('coordinates middleware', function () {
+    it('should return error: invalid zoom paramenter (-1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '-1',
+                x: '0',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, 'Invalid zoom value (-1). It should be a positive number');
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should return error: invalid zoom paramenter (1.1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1.1',
+                x: '0',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, 'Invalid zoom value (1.1). It should be a positive number');
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should return error: invalid zoom paramenter (wadus)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: 'wadus',
+                x: '0',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, 'Invalid zoom value (wadus). It should be a positive number');
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should NOT return error: \'zoom\' paramenter (1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '1',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.ifError(err);
+            done();
+        });
+    });
+
+    it('should return error: invalid coordinate \'x\' paramenter (1.1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '1.1',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, `Invalid coodinate 'x' value (1.1). It should be a number`);
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should return error: invalid coordinate \'x\' paramenter (wadus)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: 'wadus',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, `Invalid coodinate 'x' value (wadus). It should be a number`);
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should NOT return error: \'x\' paramenter (-1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '-3',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.ifError(err);
+            done();
+        });
+    });
+
+    it('should return error: invalid coordinate \'y\' paramenter (-1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '0',
+                y: '-1'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, `Invalid coodinate 'y' value (-1). It should be a positive number`);
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should return error: invalid coordinate \'y\' paramenter (1.1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '0',
+                y: '1.1'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, `Invalid coodinate 'y' value (1.1). It should be a positive number`);
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should return error: invalid coordinate \'y\' paramenter (wadus)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '0',
+                y: 'wadus'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, `Invalid coodinate 'y' value (wadus). It should be a positive number`);
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+    it('should NOT return error: \'y\' paramenter (1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '1',
+                x: '1',
+                y: '1'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.ifError(err);
+            done();
+        });
+    });
+
+    it('should validate zoom and should return error: invalid zoom paramenter (-1.1)', function (done) {
+        const coords = coordinates({ z: true, x: false, y: false });
+        const req = {
+            params: {
+                z: '-1.1'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(err.message, 'Invalid zoom value (-1.1). It should be a positive number');
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+});

From 98d15e2e346ff9b79710b4a5671300688794ca98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Mon, 16 Apr 2018 18:57:28 +0200
Subject: [PATCH 2/8] Typo

---
 lib/cartodb/middleware/coordinates.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cartodb/middleware/coordinates.js b/lib/cartodb/middleware/coordinates.js
index d02b5624..43fa0fb6 100644
--- a/lib/cartodb/middleware/coordinates.js
+++ b/lib/cartodb/middleware/coordinates.js
@@ -12,7 +12,7 @@ module.exports = function coordinates (validate = { z: true, x: true, y: true })
             return next(err);
         }
 
-        // Negatives values for x param are valid. The x param is wrapped
+        // Negative values for x param are valid. The x param is wrapped
         if (validate.x && !integerNumber.test(x)) {
             const err = new Error(`Invalid coodinate 'x' value (${x}). It should be a number`);
             err.http_status = 400;

From 8000a519187e1b406ffe24d64392a0adc63a0377 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:04:03 +0200
Subject: [PATCH 3/8] Improve error messages

---
 lib/cartodb/middleware/coordinates.js | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/cartodb/middleware/coordinates.js b/lib/cartodb/middleware/coordinates.js
index 43fa0fb6..9a83f181 100644
--- a/lib/cartodb/middleware/coordinates.js
+++ b/lib/cartodb/middleware/coordinates.js
@@ -1,12 +1,21 @@
-module.exports = function coordinates (validate = { z: true, x: true, y: true }) {
-    const positiveIntegerNumber = /^\d+$/;
-    const integerNumber = /^-?\d+$/;
+const positiveIntegerNumber = /^\d+$/;
+const integerNumber = /^-?\d+$/;
+const invalidZoomMessage = function (zoom) {
+    return `Invalid zoom value (${zoom}). It should be an integer number greather or equal to 0`;
+};
+const invalidCoordXMessage = function (x) {
+    return `Invalid coodinate 'x' value (${x}). It should be an integer number`;
+};
+const invalidCoordYMessage = function (y) {
+    return `Invalid coodinate 'y' value (${y}). It should be an integer number greather or equal to 0`;
+};
 
+module.exports = function coordinates (validate = { z: true, x: true, y: true }) {
     return function coordinatesMiddleware (req, res, next) {
         const { z, x, y } = req.params;
 
         if (validate.z && !positiveIntegerNumber.test(z)) {
-            const err = new Error(`Invalid zoom value (${z}). It should be a positive number`);
+            const err = new Error(invalidZoomMessage(z));
             err.http_status = 400;
 
             return next(err);
@@ -14,14 +23,14 @@ module.exports = function coordinates (validate = { z: true, x: true, y: true })
 
         // Negative values for x param are valid. The x param is wrapped
         if (validate.x && !integerNumber.test(x)) {
-            const err = new Error(`Invalid coodinate 'x' value (${x}). It should be a number`);
+            const err = new Error(invalidCoordXMessage(x));
             err.http_status = 400;
 
             return next(err);
         }
 
         if (validate.y && !positiveIntegerNumber.test(y)) {
-            const err = new Error(`Invalid coodinate 'y' value (${y}). It should be a positive number`);
+            const err = new Error(invalidCoordYMessage(y));
             err.http_status = 400;
 
             return next(err);

From da3939239f55278d11779042a0abd7a1f7c30446 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:10:34 +0200
Subject: [PATCH 4/8] Fix test assertions

---
 .../cartodb/middlewares/coordinates.test.js   | 39 ++++++++++++++-----
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/test/unit/cartodb/middlewares/coordinates.test.js b/test/unit/cartodb/middlewares/coordinates.test.js
index cd1d022e..be84a8e9 100644
--- a/test/unit/cartodb/middlewares/coordinates.test.js
+++ b/test/unit/cartodb/middlewares/coordinates.test.js
@@ -14,7 +14,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, 'Invalid zoom value (-1). It should be a positive number');
+            assert.equal(
+                err.message,
+                'Invalid zoom value (-1). It should be an integer number greather or equal to 0'
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -32,7 +35,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, 'Invalid zoom value (1.1). It should be a positive number');
+            assert.equal(
+                err.message,
+                'Invalid zoom value (1.1). It should be an integer number greather or equal to 0'
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -50,7 +56,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, 'Invalid zoom value (wadus). It should be a positive number');
+            assert.equal(
+                err.message,
+                'Invalid zoom value (wadus). It should be an integer number greather or equal to 0'
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -85,7 +94,7 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, `Invalid coodinate 'x' value (1.1). It should be a number`);
+            assert.equal(err.message, `Invalid coodinate 'x' value (1.1). It should be an integer number`);
             assert.equal(err.http_status, 400);
             done();
         });
@@ -103,7 +112,7 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, `Invalid coodinate 'x' value (wadus). It should be a number`);
+            assert.equal(err.message, `Invalid coodinate 'x' value (wadus). It should be an integer number`);
             assert.equal(err.http_status, 400);
             done();
         });
@@ -138,7 +147,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, `Invalid coodinate 'y' value (-1). It should be a positive number`);
+            assert.equal(
+                err.message,
+                `Invalid coodinate 'y' value (-1). It should be an integer number greather or equal to 0`
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -156,7 +168,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, `Invalid coodinate 'y' value (1.1). It should be a positive number`);
+            assert.equal(
+                err.message,
+                `Invalid coodinate 'y' value (1.1). It should be an integer number greather or equal to 0`
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -174,7 +189,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, `Invalid coodinate 'y' value (wadus). It should be a positive number`);
+            assert.equal(
+                err.message,
+                `Invalid coodinate 'y' value (wadus). It should be an integer number greather or equal to 0`
+            );
             assert.equal(err.http_status, 400);
             done();
         });
@@ -207,7 +225,10 @@ describe('coordinates middleware', function () {
         const res = {};
 
         coords(req, res, function (err) {
-            assert.equal(err.message, 'Invalid zoom value (-1.1). It should be a positive number');
+            assert.equal(
+                err.message,
+                'Invalid zoom value (-1.1). It should be an integer number greather or equal to 0'
+            );
             assert.equal(err.http_status, 400);
             done();
         });

From 94be7e5294c3d28aed4778b66c24fd89454c228e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:13:33 +0200
Subject: [PATCH 5/8] Update NEWS

---
 NEWS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/NEWS.md b/NEWS.md
index a359def5..d2e7bf6c 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -7,6 +7,7 @@ New features:
 
 
 Bug Fixes:
+- Validates tile coordinates (z/x/y) from request params to be a valid integer value.
 
 
 ## 6.1.0

From 2ff410946aa0acc4f904e7654db65e932503dd76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:20:15 +0200
Subject: [PATCH 6/8] Add test to check that the regexp validates just digits

---
 .../cartodb/middlewares/coordinates.test.js   | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/test/unit/cartodb/middlewares/coordinates.test.js b/test/unit/cartodb/middlewares/coordinates.test.js
index be84a8e9..43eb4a6c 100644
--- a/test/unit/cartodb/middlewares/coordinates.test.js
+++ b/test/unit/cartodb/middlewares/coordinates.test.js
@@ -44,6 +44,28 @@ describe('coordinates middleware', function () {
         });
     });
 
+    it('should return error: invalid zoom paramenter (0.1)', function (done) {
+        const coords = coordinates();
+        const req = {
+            params: {
+                z: '0.1',
+                x: '0',
+                y: '0'
+            }
+        };
+        const res = {};
+
+        coords(req, res, function (err) {
+            assert.equal(
+                err.message,
+                'Invalid zoom value (0.1). It should be an integer number greather or equal to 0'
+            );
+            assert.equal(err.http_status, 400);
+            done();
+        });
+    });
+
+
     it('should return error: invalid zoom paramenter (wadus)', function (done) {
         const coords = coordinates();
         const req = {

From 9905b204480d0924829f9d695fbe12f0060bbf34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:22:05 +0200
Subject: [PATCH 7/8] Improve naming

---
 lib/cartodb/middleware/coordinates.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/cartodb/middleware/coordinates.js b/lib/cartodb/middleware/coordinates.js
index 9a83f181..3d1e54af 100644
--- a/lib/cartodb/middleware/coordinates.js
+++ b/lib/cartodb/middleware/coordinates.js
@@ -1,5 +1,5 @@
-const positiveIntegerNumber = /^\d+$/;
-const integerNumber = /^-?\d+$/;
+const positiveIntegerNumberRegExp = /^\d+$/;
+const integerNumberRegExp = /^-?\d+$/;
 const invalidZoomMessage = function (zoom) {
     return `Invalid zoom value (${zoom}). It should be an integer number greather or equal to 0`;
 };
@@ -14,7 +14,7 @@ module.exports = function coordinates (validate = { z: true, x: true, y: true })
     return function coordinatesMiddleware (req, res, next) {
         const { z, x, y } = req.params;
 
-        if (validate.z && !positiveIntegerNumber.test(z)) {
+        if (validate.z && !positiveIntegerNumberRegExp.test(z)) {
             const err = new Error(invalidZoomMessage(z));
             err.http_status = 400;
 
@@ -22,14 +22,14 @@ module.exports = function coordinates (validate = { z: true, x: true, y: true })
         }
 
         // Negative values for x param are valid. The x param is wrapped
-        if (validate.x && !integerNumber.test(x)) {
+        if (validate.x && !integerNumberRegExp.test(x)) {
             const err = new Error(invalidCoordXMessage(x));
             err.http_status = 400;
 
             return next(err);
         }
 
-        if (validate.y && !positiveIntegerNumber.test(y)) {
+        if (validate.y && !positiveIntegerNumberRegExp.test(y)) {
             const err = new Error(invalidCoordYMessage(y));
             err.http_status = 400;
 

From 6c466d13ff47634bcfcdc2be5f4b348b8e61077b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?=
 <danielgarciaaubert@gmail.com>
Date: Tue, 17 Apr 2018 11:36:33 +0200
Subject: [PATCH 8/8] Typo

---
 lib/cartodb/middleware/coordinates.js            |  4 ++--
 .../unit/cartodb/middlewares/coordinates.test.js | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/cartodb/middleware/coordinates.js b/lib/cartodb/middleware/coordinates.js
index 3d1e54af..d0840393 100644
--- a/lib/cartodb/middleware/coordinates.js
+++ b/lib/cartodb/middleware/coordinates.js
@@ -1,13 +1,13 @@
 const positiveIntegerNumberRegExp = /^\d+$/;
 const integerNumberRegExp = /^-?\d+$/;
 const invalidZoomMessage = function (zoom) {
-    return `Invalid zoom value (${zoom}). It should be an integer number greather or equal to 0`;
+    return `Invalid zoom value (${zoom}). It should be an integer number greather than or equal to 0`;
 };
 const invalidCoordXMessage = function (x) {
     return `Invalid coodinate 'x' value (${x}). It should be an integer number`;
 };
 const invalidCoordYMessage = function (y) {
-    return `Invalid coodinate 'y' value (${y}). It should be an integer number greather or equal to 0`;
+    return `Invalid coodinate 'y' value (${y}). It should be an integer number greather than or equal to 0`;
 };
 
 module.exports = function coordinates (validate = { z: true, x: true, y: true }) {
diff --git a/test/unit/cartodb/middlewares/coordinates.test.js b/test/unit/cartodb/middlewares/coordinates.test.js
index 43eb4a6c..11cd2626 100644
--- a/test/unit/cartodb/middlewares/coordinates.test.js
+++ b/test/unit/cartodb/middlewares/coordinates.test.js
@@ -16,7 +16,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                'Invalid zoom value (-1). It should be an integer number greather or equal to 0'
+                'Invalid zoom value (-1). It should be an integer number greather than or equal to 0'
             );
             assert.equal(err.http_status, 400);
             done();
@@ -37,7 +37,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                'Invalid zoom value (1.1). It should be an integer number greather or equal to 0'
+                'Invalid zoom value (1.1). It should be an integer number greather than or equal to 0'
             );
             assert.equal(err.http_status, 400);
             done();
@@ -58,7 +58,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                'Invalid zoom value (0.1). It should be an integer number greather or equal to 0'
+                'Invalid zoom value (0.1). It should be an integer number greather than or equal to 0'
             );
             assert.equal(err.http_status, 400);
             done();
@@ -80,7 +80,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                'Invalid zoom value (wadus). It should be an integer number greather or equal to 0'
+                'Invalid zoom value (wadus). It should be an integer number greather than or equal to 0'
             );
             assert.equal(err.http_status, 400);
             done();
@@ -171,7 +171,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                `Invalid coodinate 'y' value (-1). It should be an integer number greather or equal to 0`
+                `Invalid coodinate 'y' value (-1). It should be an integer number greather than or equal to 0`
             );
             assert.equal(err.http_status, 400);
             done();
@@ -192,7 +192,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                `Invalid coodinate 'y' value (1.1). It should be an integer number greather or equal to 0`
+                `Invalid coodinate 'y' value (1.1). It should be an integer number greather than or equal to 0`
             );
             assert.equal(err.http_status, 400);
             done();
@@ -213,7 +213,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                `Invalid coodinate 'y' value (wadus). It should be an integer number greather or equal to 0`
+                `Invalid coodinate 'y' value (wadus). It should be an integer number greather than or equal to 0`
             );
             assert.equal(err.http_status, 400);
             done();
@@ -249,7 +249,7 @@ describe('coordinates middleware', function () {
         coords(req, res, function (err) {
             assert.equal(
                 err.message,
-                'Invalid zoom value (-1.1). It should be an integer number greather or equal to 0'
+                'Invalid zoom value (-1.1). It should be an integer number greather than or equal to 0'
             );
             assert.equal(err.http_status, 400);
             done();