Validate aggregation expresions

2019-03-01 17:02:06 +01:00
parent 57a229655c
commit f9e5d9d0a9
2 changed files with 160 additions and 15 deletions
@@ -90,6 +90,36 @@ module.exports = class ClusterBackend {

                        return callback(error);
                    }
+
+                    for (const [columnName, exp] of Object.entries(expressions)) {
+                        const { aggregate_function, aggregated_column } = exp;
+
+                        if (typeof aggregated_column !== 'string') {
+                            const error = new Error(`Invalid aggregation input, aggregated column should be an string`);
+                            error.http_status = 400;
+                            error.type = 'layer';
+                            error.subtype = 'aggregation';
+                            error.layer = {
+                                index: layerIndex,
+                                type: layer.type
+                            };
+
+                            return callback(error);
+                        }
+
+                        if (typeof aggregate_function !== 'string') {
+                            const error = new Error(`Invalid aggregation input, aggregate function should be an string`);
+                            error.http_status = 400;
+                            error.type = 'layer';
+                            error.subtype = 'aggregation';
+                            error.layer = {
+                                index: layerIndex,
+                                type: layer.type
+                            };
+
+                            return callback(error);
+                        }
+                    }
                }
            }

@@ -153,7 +183,8 @@ function getClusterFeatures (pg, zoom, clusterId, columns, query, resolution, ag
        let { columns = [], expressions = [] } = aggregation;

        if (expressions) {
-            expressions = Object.entries(expressions).map(entries =>`${entries[1].aggregated_function}(${entries[1].aggregated_column}) AS ${entries[0]}`);
+            expressions = Object.entries(expressions)
+                .map(([columnName, exp]) => `${exp.aggregate_function}(${exp.aggregated_column}) AS ${columnName}`);
        }

        sql = aggregationQuery({