Function enforceRouteAllowList

src/middlewares.js:534–570

(req, res, next)

}

export function enforceRouteAllowList(req, res, next) {
  const config = req.config;
  if (!config || config.routeAllowList === undefined || config.routeAllowList === null) {
    return next();
  }
  if (req.auth && (req.auth.isMaster || req.auth.isMaintenance)) {
    return next();
  }
  let path = req.originalUrl;
  if (config.mount) {
    const mountPath = new URL(config.mount).pathname;
    if (path.startsWith(mountPath)) {
      path = path.substring(mountPath.length);
    }
  }
  if (path.startsWith('/')) {
    path = path.substring(1);
  }
  if (path.endsWith('/')) {
    path = path.substring(0, path.length - 1);
  }
  const queryIndex = path.indexOf('?');
  if (queryIndex !== -1) {
    path = path.substring(0, queryIndex);
  }
  const regexes = config._routeAllowListRegex || [];
  for (const regex of regexes) {
    if (regex.test(path)) {
      return next();
    }
  }
  throw createSanitizedError(
    Parse.Error.OPERATION_FORBIDDEN,
    `Route not allowed by routeAllowList: ${req.method} ${path}`,
    config
  );
}

export function handleParseErrors(err, req, res, next) {
  const log = (req.config && req.config.loggerController) || defaultLogger;