Skip to content

fix(logger): guard fetchResource against unknown resource name#284

Open
WhereiamL wants to merge 1 commit into
overextended:mainfrom
WhereiamL:fix/fetchresource-unknown-resource
Open

fix(logger): guard fetchResource against unknown resource name#284
WhereiamL wants to merge 1 commit into
overextended:mainfrom
WhereiamL:fix/fetchresource-unknown-resource

Conversation

@WhereiamL

Copy link
Copy Markdown

Problem

The oxmysql:fetchResource net handler validates that data.resource is a string, but never checks that it actually exists in logStorage before indexing it:

const resourceLog = data.search
  ? logStorage[data.resource].filter((q) => q.query.toLowerCase().includes(data.search))
  : logStorage[data.resource];

If data.resource is any string that isn't a known resource key, logStorage[data.resource] is undefined and the .filter() call (search branch) throws Cannot read properties of undefined. The non-search branch then feeds undefined into resourceLog.slice() / resourceLog.length further down, which throws as well.

This is gated behind command.mysql, so it isn't a privilege issue, but a permitted user (or a UI request racing a resource that hasn't logged anything yet) can throw an unhandled exception in the handler.

Fix

Resolve the log entry once and bail out early when the resource has no stored queries, before any access.

logStorage[data.resource] is undefined for any resource key that has not logged a query, causing fetchResource to throw on .filter()/.slice(). Bail out early when there is no stored log for the requested resource.
@unitysync unitysync requested a review from thelindat June 24, 2026 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant