🐛 fix code scanning alerts "server-side request forgery"

daodaoedu · Mar 1, 2024 · 93cdc72 · 93cdc72
1 parent c8489d1
commit 93cdc72
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/pages/group/edit/index.jsx b/pages/group/edit/index.jsx
@@ -36,14 +36,17 @@ function EditGroupPage() {
   const goToDetail = () => router.replace(`/group/detail?id=${id}`);
 
   const { mutate, isLoading } = useMutation(
-    (values) =>
-      fetch(`${GROUP_API_URL}/${id}`, {
+    (values) => {
+      if (!id || id.includes('/')) return Promise.reject();
+
+      return fetch(`${GROUP_API_URL}/${id}`, {
         method: 'PUT',
         body: JSON.stringify(values),
         headers: {
           'Content-Type': 'application/json',
         },
-      }),
+      });
+    },
     { onSuccess: goToDetail },
   );