Validate static command argument type before deserialization

riganti · Oct 22, 2023 · ad22f49 · ad22f49
1 parent 35096fd
commit ad22f49
Showing 1 changed file with 13 additions and 1 deletion.
diff --git a/src/Framework/Framework/Hosting/DotvvmPresenter.cs b/src/Framework/Framework/Hosting/DotvvmPresenter.cs
@@ -333,8 +333,20 @@ public async Task ProcessRequestCore(IDotvvmRequestContext context)
 
         private object? ExecuteStaticCommandPlan(StaticCommandInvocationPlan plan, Queue<JToken> arguments, IDotvvmRequestContext context)
         {
+            var parameters = plan.Method.GetParameters();
+            object? DeserializeArgument(Type type, int index)
+            {
+                var parameterType =
+                    plan.Method.IsStatic ? parameters[index].ParameterType :
+                    index == 0 ? plan.Method.DeclaringType :
+                    parameters[index - 1].ParameterType;
+                if (!parameterType!.IsAssignableFrom(type))
+                    throw new Exception($"Argument {index} has an invalid type");
+                var arg = arguments.Dequeue();
+                return arg.ToObject(type);
+            }
             var methodArgs = plan.Arguments.Select((a, index) =>
-                a.Type == StaticCommandParameterType.Argument ? arguments.Dequeue().ToObject((Type)a.Arg!) :
+                a.Type == StaticCommandParameterType.Argument ? DeserializeArgument((Type)a.Arg!, index) :
                 a.Type == StaticCommandParameterType.Constant || a.Type == StaticCommandParameterType.DefaultValue ? a.Arg :
                 a.Type == StaticCommandParameterType.Inject ?
 #pragma warning disable CS0618