This commit was merged in pull request #155.
This commit is contained in:
@@ -91,6 +91,7 @@ export class StockController {
|
||||
@Body(new ValidationPipe({ forbidNonWhitelisted: true, forbidUnknownValues: true, whitelist: true }))
|
||||
criteria: StockScreenerCriteriaDto,
|
||||
) {
|
||||
// The global whitelist pipe strips unknown keys before this param pipe runs, so only the raw body can reject them.
|
||||
const allowed = new Set(['countryOfRisk', 'currency', 'maxLot', 'query', 'realExchange', 'sector', 'shareType']);
|
||||
if (Object.keys(request.body as object).some((key) => !allowed.has(key))) {
|
||||
throw new BadRequestException();
|
||||
|
||||
Reference in New Issue
Block a user