fix: Convert all Body to String Before Use (#382)

.eslintrc

@@ -19,7 +19,7 @@
         "@typescript-eslint/no-unsafe-member-access": "warn",
         "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
         "@typescript-eslint/no-misused-promises": "warn",
-        "@typescript-eslint/no-unsafe-argument": "warn",
+        "@typescript-eslint/no-unsafe-argument": "error",
         "@typescript-eslint/no-unsafe-call": "warn",
         "@typescript-eslint/no-unsafe-assignment": "warn",
         "@typescript-eslint/no-explicit-any": "warn",

src/controllers/api/addFriendImageController.ts

@@ -7,7 +7,7 @@ import { getInventory } from "@/src/services/inventoryService";
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const addFriendImageController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
-    const json = getJSONfromString(req.body.toString()) as IUpdateGlyphRequest;
+    const json = getJSONfromString(String(req.body)) as IUpdateGlyphRequest;
     const inventory = await getInventory(accountId);
     inventory.ActiveAvatarImageType = json.AvatarImageType;
     await inventory.save();

src/controllers/api/claimCompletedRecipeController.ts

@@ -15,7 +15,7 @@ export interface IClaimCompletedRecipeRequest {
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const claimCompletedRecipeController: RequestHandler = async (req, res) => {
-    const claimCompletedRecipeRequest = getJSONfromString(req.body.toString()) as IClaimCompletedRecipeRequest;
+    const claimCompletedRecipeRequest = getJSONfromString(String(req.body)) as IClaimCompletedRecipeRequest;
     const accountId = await getAccountIdForRequest(req);
     if (!accountId) throw new Error("no account id");
 

src/controllers/api/createGuildController.ts

@@ -8,7 +8,7 @@ import { ICreateGuildRequest } from "@/src/types/guildTypes";
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const createGuildController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
-    const payload: ICreateGuildRequest = getJSONfromString(req.body.toString());
+    const payload = getJSONfromString(String(req.body)) as ICreateGuildRequest;
 
     // Create guild on database
     const guild = new Guild({

src/controllers/api/evolveWeaponController.ts

@@ -9,7 +9,7 @@ import { EquipmentFeatures } from "@/src/types/inventoryTypes/commonInventoryTyp
 export const evolveWeaponController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
     const inventory = await getInventory(accountId);
-    const payload = getJSONfromString(req.body.toString()) as IEvolveWeaponRequest;
+    const payload = getJSONfromString(String(req.body)) as IEvolveWeaponRequest;
     console.assert(payload.Action == "EWA_INSTALL");
 
     // TODO: We should remove the Genesis item & its resources, but currently we don't know these "recipes".

src/controllers/api/findSessionsController.ts

@@ -4,25 +4,25 @@ import { logger } from "@/src/utils/logger";
 
 //TODO: cleanup
 const findSessionsController: RequestHandler = (_req, res) => {
-    const reqBody = JSON.parse(_req.body);
+    const reqBody = JSON.parse(String(_req.body));
     logger.debug("FindSession Request ", { reqBody });
-    const req = JSON.parse(_req.body);
+    const req = JSON.parse(String(_req.body));
     if (req.id != undefined) {
         logger.debug("Found ID");
-        const session = getSession(req.id);
+        const session = getSession(req.id as string);
 
         if (session) res.json({ queryId: req.queryId, Sessions: session });
         else res.json({});
     } else if (req.originalSessionId != undefined) {
         logger.debug("Found OriginalSessionID");
 
-        const session = getSession(req.originalSessionId);
+        const session = getSession(req.originalSessionId as string);
         if (session) res.json({ queryId: req.queryId, Sessions: session });
         else res.json({});
     } else {
         logger.debug("Found SessionRequest");
 
-        const session = getSession(_req.body);
+        const session = getSession(String(_req.body));
         if (session) res.json({ queryId: req.queryId, Sessions: session });
         else res.json({});
     }

src/controllers/api/focusController.ts

@@ -15,7 +15,7 @@ export const focusController: RequestHandler = async (req, res) => {
             res.end();
             break;
         case FocusOperation.UnlockWay: {
-            const focusType = (JSON.parse(req.body.toString()) as IWayRequest).FocusType;
+            const focusType = (JSON.parse(String(req.body)) as IWayRequest).FocusType;
             const focusPolarity = focusTypeToPolarity(focusType);
             const inventory = await getInventory(accountId);
             const cost = inventory.FocusAbility ? 50_000 : 0;
@@ -32,7 +32,7 @@ export const focusController: RequestHandler = async (req, res) => {
             break;
         }
         case FocusOperation.ActivateWay: {
-            const focusType = (JSON.parse(req.body.toString()) as IWayRequest).FocusType;
+            const focusType = (JSON.parse(String(req.body)) as IWayRequest).FocusType;
             const inventory = await getInventory(accountId);
             inventory.FocusAbility = focusType;
             await inventory.save();
@@ -40,7 +40,7 @@ export const focusController: RequestHandler = async (req, res) => {
             break;
         }
         case FocusOperation.UnlockUpgrade: {
-            const request = JSON.parse(req.body.toString()) as IUnlockUpgradeRequest;
+            const request = JSON.parse(String(req.body)) as IUnlockUpgradeRequest;
             const focusPolarity = focusTypeToPolarity(request.FocusTypes[0]);
             const inventory = await getInventory(accountId);
             let cost = 0;
@@ -57,7 +57,7 @@ export const focusController: RequestHandler = async (req, res) => {
             break;
         }
         case FocusOperation.LevelUpUpgrade: {
-            const request = JSON.parse(req.body.toString()) as ILevelUpUpgradeRequest;
+            const request = JSON.parse(String(req.body)) as ILevelUpUpgradeRequest;
             const focusPolarity = focusTypeToPolarity(request.FocusInfos[0].ItemType);
             const inventory = await getInventory(accountId);
             let cost = 0;
@@ -75,7 +75,7 @@ export const focusController: RequestHandler = async (req, res) => {
             break;
         }
         case FocusOperation.UnbindUpgrade: {
-            const request = JSON.parse(req.body.toString()) as IUnbindUpgradeRequest;
+            const request = JSON.parse(String(req.body)) as IUnbindUpgradeRequest;
             const focusPolarity = focusTypeToPolarity(request.FocusTypes[0]);
             const inventory = await getInventory(accountId);
             inventory.FocusXP[focusPolarity] -= 750_000 * request.FocusTypes.length;
@@ -105,7 +105,7 @@ export const focusController: RequestHandler = async (req, res) => {
             break;
         }
         case FocusOperation.ConvertShard: {
-            const request = JSON.parse(req.body.toString()) as IConvertShardRequest;
+            const request = JSON.parse(String(req.body)) as IConvertShardRequest;
             // Tally XP
             let xp = 0;
             for (const shard of request.Shards) {

src/controllers/api/genericUpdateController.ts

@@ -2,11 +2,12 @@ import { getAccountIdForRequest } from "@/src/services/loginService";
 import { updateGeneric } from "@/src/services/inventoryService";
 import { RequestHandler } from "express";
 import { getJSONfromString } from "@/src/helpers/stringHelpers";
+import { IGenericUpdate } from "@/src/types/genericUpdate";
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const genericUpdateController: RequestHandler = async (request, response) => {
     const accountId = await getAccountIdForRequest(request);
-    const update = getJSONfromString(request.body.toString());
+    const update = getJSONfromString(String(request.body)) as IGenericUpdate;
     response.json(await updateGeneric(update, accountId));
 };
 

src/controllers/api/infestedFoundryController.ts

@@ -7,11 +7,10 @@ import { IOid } from "@/src/types/commonTypes";
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const infestedFoundryController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
-    const payload = getJSONfromString(req.body.toString());
     switch (req.query.mode) {
         case "s": {
             // shard installation
-            const request = payload as IShardInstallRequest;
+            const request = getJSONfromString(String(req.body)) as IShardInstallRequest;
             const inventory = await getInventory(accountId);
             const suit = inventory.Suits.find(suit => suit._id.toString() == request.SuitId.$oid)!;
             if (
@@ -42,9 +41,10 @@ export const infestedFoundryController: RequestHandler = async (req, res) => {
 
         case "n": {
             // name the beast
+            const request = getJSONfromString(String(req.body)) as IHelminthNameRequest;
             const inventory = await getInventory(accountId);
             inventory.InfestedFoundry ??= {};
-            inventory.InfestedFoundry.Name = payload.newName as string;
+            inventory.InfestedFoundry.Name = request.newName;
             await inventory.save();
             res.json({
                 InventoryChanges: {
@@ -73,6 +73,10 @@ interface IShardInstallRequest {
     Color: string;
 }
 
+interface IHelminthNameRequest {
+    newName: string;
+}
+
 const colorToShard: Record<string, string> = {
     ACC_RED: "/Lotus/Types/Gameplay/NarmerSorties/ArchonCrystalAmar",
     ACC_RED_MYTHIC: "/Lotus/Types/Gameplay/NarmerSorties/ArchonCrystalAmarMythic",

src/controllers/api/joinSessionController.ts

@@ -3,10 +3,10 @@ import { getSessionByID } from "@/src/managers/sessionManager";
 import { logger } from "@/src/utils/logger";
 
 const joinSessionController: RequestHandler = (_req, res) => {
-    const reqBody = JSON.parse(_req.body);
+    const reqBody = JSON.parse(String(_req.body));
     logger.debug(`JoinSession Request`, { reqBody });
-    const req = JSON.parse(_req.body);
-    const session = getSessionByID(req.sessionIds[0]);
+    const req = JSON.parse(String(_req.body));
+    const session = getSessionByID(req.sessionIds[0] as string);
     res.json({ rewardSeed: session?.rewardSeed, sessionId: { $oid: session?.sessionId } });
 };
 

src/controllers/api/modularWeaponCraftingController.ts

@@ -22,7 +22,7 @@ interface IModularCraftRequest {
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const modularWeaponCraftingController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
-    const data: IModularCraftRequest = getJSONfromString(req.body.toString());
+    const data = getJSONfromString(String(req.body)) as IModularCraftRequest;
     if (!(data.WeaponType in modularWeaponTypes)) {
         throw new Error(`unknown modular weapon type: ${data.WeaponType}`);
     }

src/controllers/api/nameWeaponController.ts

@@ -12,7 +12,7 @@ interface INameWeaponRequest {
 export const nameWeaponController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
     const inventory = await getInventory(accountId);
-    const body = getJSONfromString(req.body.toString()) as INameWeaponRequest;
+    const body = getJSONfromString(String(req.body)) as INameWeaponRequest;
     const item = inventory[req.query.Category as string as TEquipmentKey].find(
         item => item._id.toString() == (req.query.ItemId as string)
     )!;

src/controllers/api/sellController.ts

@@ -5,7 +5,7 @@ import { getInventory, addMods, addRecipes } from "@/src/services/inventoryServi
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const sellController: RequestHandler = async (req, res) => {
-    const payload: ISellRequest = JSON.parse(req.body.toString());
+    const payload = JSON.parse(String(req.body)) as ISellRequest;
     const accountId = await getAccountIdForRequest(req);
     const inventory = await getInventory(accountId);
 

src/controllers/api/setWeaponSkillTreeController.ts

@@ -8,7 +8,7 @@ import { WeaponTypeInternal } from "@/src/services/itemDataService";
 export const setWeaponSkillTreeController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
     const inventory = await getInventory(accountId);
-    const payload = getJSONfromString(req.body.toString()) as ISetWeaponSkillTreeRequest;
+    const payload = getJSONfromString(String(req.body)) as ISetWeaponSkillTreeRequest;
 
     const item = inventory[req.query.Category as WeaponTypeInternal].find(
         item => item._id.toString() == (req.query.ItemId as string)

src/controllers/api/startDojoRecipeController.ts

@@ -12,7 +12,7 @@ interface IStartDojoRecipeRequest {
 export const startDojoRecipeController: RequestHandler = async (req, res) => {
     const guild = await getGuildForRequest(req);
     // At this point, we know that a member of the guild is making this request. Assuming they are allowed to start a build.
-    const request = JSON.parse(req.body.toString()) as IStartDojoRecipeRequest;
+    const request = JSON.parse(String(req.body)) as IStartDojoRecipeRequest;
     guild.DojoComponents!.push({
         _id: new Types.ObjectId(),
         pf: request.PlacedComponent.pf,

src/controllers/api/startRecipeController.ts

@@ -11,7 +11,7 @@ interface IStartRecipeRequest {
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const startRecipeController: RequestHandler = async (req, res) => {
-    const startRecipeRequest = getJSONfromString(req.body.toString()) as IStartRecipeRequest;
+    const startRecipeRequest = getJSONfromString(String(req.body)) as IStartRecipeRequest;
     logger.debug("StartRecipe Request", { startRecipeRequest });
 
     const accountId = await getAccountIdForRequest(req);

src/controllers/api/stepSequencersController.ts

@@ -7,7 +7,7 @@ import { IStepSequencer } from "@/src/types/inventoryTypes/inventoryTypes";
 export const stepSequencersController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
     const inventory = await getInventory(accountId);
-    const stepSequencer = JSON.parse(req.body.toString()) as IStepSequencer;
+    const stepSequencer = JSON.parse(String(req.body)) as IStepSequencer;
     delete stepSequencer.ItemId;
     const stepSequencerIndex = inventory.StepSequencers.push(stepSequencer);
     const changedInventory = await inventory.save();

src/controllers/api/syndicateSacrificeController.ts

@@ -7,10 +7,9 @@ import { getAccountIdForRequest } from "@/src/services/loginService";
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const syndicateSacrificeController: RequestHandler = async (request, response) => {
     const accountId = await getAccountIdForRequest(request);
-    const body = getJSONfromString(request.body);
+    const update = getJSONfromString(String(request.body)) as ISyndicateSacrifice;
     let reply = {};
     try {
-        const update = JSON.parse(body) as ISyndicateSacrifice;
         if (typeof update !== "object") {
             throw new Error("Invalid data format");
         }

src/controllers/api/trainingResultController.ts

@@ -19,7 +19,7 @@ interface ITrainingResultsResponse {
 const trainingResultController: RequestHandler = async (req, res): Promise<void> => {
     const accountId = await getAccountIdForRequest(req);
 
-    const trainingResults = getJSONfromString(req.body.toString()) as ITrainingResultsRequest;
+    const trainingResults = getJSONfromString(String(req.body)) as ITrainingResultsRequest;
 
     const inventory = await getInventory(accountId);
 

src/controllers/api/updateChallengeProgressController.ts

@@ -6,7 +6,7 @@ import { IUpdateChallengeProgressRequest } from "@/src/types/requestTypes";
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const updateChallengeProgressController: RequestHandler = async (req, res) => {
-    const payload: IUpdateChallengeProgressRequest = getJSONfromString(req.body.toString());
+    const payload = getJSONfromString(String(req.body)) as IUpdateChallengeProgressRequest;
     const accountId = await getAccountIdForRequest(req);
 
     await updateChallengeProgress(payload, accountId);

src/controllers/api/updateSessionController.ts

@@ -5,9 +5,9 @@ const updateSessionGetController: RequestHandler = (_req, res) => {
     res.json({});
 };
 const updateSessionPostController: RequestHandler = (_req, res) => {
-    console.log("UpdateSessions POST Request:", JSON.parse(_req.body));
+    console.log("UpdateSessions POST Request:", JSON.parse(String(_req.body)));
     console.log("ReqID:", _req.query.sessionId as string);
-    updateSession(_req.query.sessionId as string, _req.body);
+    updateSession(_req.query.sessionId as string, String(_req.body));
     res.json({});
 };
 export { updateSessionGetController, updateSessionPostController };

src/controllers/api/upgradesController.ts

@@ -12,7 +12,7 @@ import { addMiscItems, getInventory, updateCurrency } from "@/src/services/inven
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 export const upgradesController: RequestHandler = async (req, res) => {
     const accountId = await getAccountIdForRequest(req);
-    const payload = JSON.parse(req.body.toString()) as IUpgradesRequest;
+    const payload = JSON.parse(String(req.body)) as IUpgradesRequest;
     const inventory = await getInventory(accountId);
     const InventoryChanges: any = {};
     for (const operation of payload.Operations) {

src/controllers/custom/updateConfigDataController.ts

@@ -3,7 +3,7 @@ import { updateConfig } from "@/src/services/configService";
 
 // eslint-disable-next-line @typescript-eslint/no-misused-promises
 const updateConfigDataController: RequestHandler = async (req, res) => {
-    await updateConfig(req.body.toString());
+    await updateConfig(String(req.body));
     res.end();
 };