Merge pull request #1480 from basedosdados/fix/table_get

feat: Implement UUID validation for dataset and table API IDs and update dependencies.

Author: AldemirLucas

next/package-lock.json

@@ -48,7 +48,8 @@
     "react-query": "^3.39.2",
     "rehype-slug": "^6.0.0",
     "remark-gfm": "^4.0.0",
-    "swiper": "^8.4.5"
+    "swiper": "^8.4.5",
+    "uuid": "^13.0.0"
   },
   "devDependencies": {
     "cypress": "^14.4.0",

next/package.json

@@ -1,9 +1,14 @@
 import axios from "axios";
 import { capitalize } from 'lodash';
+import { validate as isUuid } from "uuid";
 
 const API_URL = `${process.env.NEXT_PUBLIC_API_URL}/api/v1/graphql`;
 
 export default async function getDataset(id, locale = 'pt') {
+  if (!id || !isUuid(id)) {
+    return null;
+  }
+
   try {
     const res = await axios({
       url: API_URL,

next/pages/api/datasets/getDataset.js

@@ -1,6 +1,7 @@
 import axios from "axios";
 import { cleanGraphQLResponse } from "../../../utils";
 import { capitalize } from 'lodash';
+import { validate as isUuid } from "uuid";
 
 const API_URL= `${process.env.NEXT_PUBLIC_API_URL}/api/v1/graphql`
 
@@ -146,7 +147,12 @@ async function getTable(id, locale='pt') {
 }
 
 export default async function handler(req, res) {
-  const { id: id, locale } = req.query;
+  const { id, locale } = req.query;
+
+  if (!id || !isUuid(id)) {
+    return res.status(400).json({ error: "Invalid or missing ID in Table", success: false });
+  }
+
   const result = await getTable(id, locale);
 
   if(result.errors) return res.status(500).json({error: result.errors, success: false})

next/pages/api/tables/getTable.js

@@ -1,4 +1,5 @@
 import axios from "axios";
+import { validate as isUuid } from "uuid";
 
 async function getTableColumns(id) {
   const API_URL = `${process.env.NEXT_PUBLIC_API_URL}/tables/${id}/columns/`;
@@ -18,6 +19,11 @@ async function getTableColumns(id) {
 
 export default async function handler(req, res) {
   const { id } = req.query;
+
+  if (!id || !isUuid(id)) {
+    return res.status(400).json({ error: "Invalid or missing ID", success: false });
+  }
+
   const result = await getTableColumns(id);
 
   if (result === "err") return res.status(500).json({ error: "err", success: false });