From 94244cb55f14268351dc98d079379cc16e52af38 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Mon, 9 Jan 2023 17:04:17 +0800
Subject: [PATCH] core: oplog: santitize argument keys

---
 packages/hydrooj/src/model/oplog.ts | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/packages/hydrooj/src/model/oplog.ts b/packages/hydrooj/src/model/oplog.ts
index 4add803cb..23c4508eb 100644
--- a/packages/hydrooj/src/model/oplog.ts
+++ b/packages/hydrooj/src/model/oplog.ts
@@ -1,3 +1,4 @@
+import { cloneDeep } from 'lodash';
 import { ObjectID } from 'mongodb';
 import { OplogDoc } from '../interface';
 import * as bus from '../service/bus';
@@ -16,10 +17,28 @@ export async function add(data: Partial<OplogDoc> & { type: string }): Promise<O
     return res.insertedId;
 }
 
+function safeKeys(data: any) {
+    if (['string', 'number', 'boolean'].includes(typeof data)) return data;
+    if (data instanceof Array) data.forEach(safeKeys);
+    else if (data instanceof ObjectID) return data;
+    else if (data instanceof Object) {
+        for (const key in data) {
+            if (['password', 'verifyPassword'].includes(key)) {
+                delete data[key];
+                continue;
+            }
+            safeKeys(data[key]);
+            if (key.includes('$') || key.includes('.')) {
+                data[key.replace(/[$.]/g, '_')] = data[key];
+                delete data[key];
+            }
+        }
+    }
+    return data;
+}
+
 export async function log<T extends Handler>(handler: T, type: string, data: any) {
-    const args = { ...handler.args };
-    delete args.password;
-    delete args.verifyPassword;
+    const args = safeKeys(cloneDeep(handler.args));
     await bus.parallel('oplog/log', type, handler, args, data);
     const res = await coll.insertOne({
         ...data,