From e2c2e06d651ce5316f900207ad2f1085c19fdb64 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Thu, 30 Mar 2017 20:12:55 +0200
Subject: [PATCH] Configure extra allowed params per endpoint via middleware

Instead of making all params available in all endpoints, we control
what endpoints allow what extra params.

Dataviews endpoints should be migrated to this.
---
 lib/cartodb/controllers/base.js              | 8 ++++++--
 lib/cartodb/controllers/layergroup.js        | 7 +++++--
 lib/cartodb/controllers/named_maps.js        | 3 ++-
 lib/cartodb/middleware/allow-query-params.js | 6 ++++++
 4 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 lib/cartodb/middleware/allow-query-params.js

diff --git a/lib/cartodb/controllers/base.js b/lib/cartodb/controllers/base.js
index 4ce9af17..aa607a87 100644
--- a/lib/cartodb/controllers/base.js
+++ b/lib/cartodb/controllers/base.js
@@ -36,7 +36,7 @@ function BaseController(authApi, pgConnection) {
 
 module.exports = BaseController;
 
-// jshint maxcomplexity:9
+// jshint maxcomplexity:10
 /**
  * Whitelist input and get database name & default geometry type from
  * subdomain/user metadata held in CartoDB Redis
@@ -77,7 +77,11 @@ BaseController.prototype.req2params = function(req, callback){
         return;
     }
 
-    req.query = _.pick(req.query, REQUEST_QUERY_PARAMS_WHITELIST);
+    var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
+    if (Array.isArray(req.context.allowedQueryParams)) {
+        allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams);
+    }
+    req.query = _.pick(req.query, allowedQueryParams);
     req.params = _.extend({}, req.params); // shuffle things as request is a strange array/object
 
     var user = req.context.user;
diff --git a/lib/cartodb/controllers/layergroup.js b/lib/cartodb/controllers/layergroup.js
index f7215943..4119655f 100644
--- a/lib/cartodb/controllers/layergroup.js
+++ b/lib/cartodb/controllers/layergroup.js
@@ -6,6 +6,7 @@ var BaseController = require('./base');
 
 var cors = require('../middleware/cors');
 var userMiddleware = require('../middleware/user');
+var allowQueryParams = require('../middleware/allow-query-params');
 
 var DataviewBackend = require('../backends/dataview');
 var AnalysisStatusBackend = require('../backends/analysis-status');
@@ -67,11 +68,13 @@ LayergroupController.prototype.register = function(app) {
         this.attributes.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/center/:token/:z/:lat/:lng/:width/:height.:format', cors(), userMiddleware,
+        '/static/center/:token/:z/:lat/:lng/:width/:height.:format',
+        cors(), userMiddleware, allowQueryParams(['layer']),
         this.center.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format', cors(), userMiddleware,
+        '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format',
+        cors(), userMiddleware, allowQueryParams(['layer']),
         this.bbox.bind(this));
 
     // Undocumented/non-supported API endpoint methods.
diff --git a/lib/cartodb/controllers/named_maps.js b/lib/cartodb/controllers/named_maps.js
index 4d22aeea..6681a893 100644
--- a/lib/cartodb/controllers/named_maps.js
+++ b/lib/cartodb/controllers/named_maps.js
@@ -8,6 +8,7 @@ var BaseController = require('./base');
 
 var cors = require('../middleware/cors');
 var userMiddleware = require('../middleware/user');
+var allowQueryParams = require('../middleware/allow-query-params');
 
 function NamedMapsController(authApi, pgConnection, namedMapProviderCache, tileBackend, previewBackend,
                              surrogateKeysCache, tablesExtentApi, metadataBackend) {
@@ -31,7 +32,7 @@ NamedMapsController.prototype.register = function(app) {
         this.tile.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/named/:template_id/:width/:height.:format', cors(), userMiddleware,
+        '/static/named/:template_id/:width/:height.:format', cors(), userMiddleware, allowQueryParams(['layer']),
         this.staticMap.bind(this));
 };
 
diff --git a/lib/cartodb/middleware/allow-query-params.js b/lib/cartodb/middleware/allow-query-params.js
new file mode 100644
index 00000000..82c255f7
--- /dev/null
+++ b/lib/cartodb/middleware/allow-query-params.js
@@ -0,0 +1,6 @@
+module.exports = function allowQueryParams(params) {
+    return function allowQueryParamsMiddleware(req, res, next) {
+        req.context.allowedQueryParams = params;
+        next();
+    };
+};