fix: bug (#4816)

packages/plugins/@nocobase/plugin-data-visualization/src/server/__tests__/query.test.ts

@@ -182,6 +182,31 @@ describe('query', () => {
       ]);
     });
 
+    it('should throw error if invalid aggregation function', async () => {
+      const measures = [
+        {
+          field: ['price'],
+          aggregation: 'if(1=2,sleep(1),sleep(3)) and sum',
+        },
+      ];
+      const context = {
+        ...ctx,
+        action: {
+          params: {
+            values: {
+              collection: 'orders',
+              measures,
+            },
+          },
+        },
+      };
+      try {
+        await compose([parseFieldAndAssociations, parseBuilder])(context, async () => {});
+      } catch (error) {
+        expect(error.message).toBe('Invalid aggregation function: if(1=2,sleep(1),sleep(3)) and sum');
+      }
+    });
+
     it('should parse dimensions', async () => {
       vi.spyOn(formatter, 'formatter').mockReturnValue('formatted-field');
       const dimensions = [

packages/plugins/@nocobase/plugin-data-visualization/src/server/actions/query.ts

@@ -55,6 +55,8 @@ type QueryParams = Partial<{
   refresh: boolean;
 }>;
 
+const AllowedAggFuncs = ['sum', 'count', 'avg', 'min', 'max'];
+
 const getDB = (ctx: Context, dataSource: string) => {
   const ds = ctx.app.dataSourceManager.dataSources.get(dataSource);
   return ds?.collectionManager.db;
@@ -119,6 +121,9 @@ export const parseBuilder = async (ctx: Context, next: Next) => {
     const attribute = [];
     const col = sequelize.col(field);
     if (aggregation) {
+      if (!AllowedAggFuncs.includes(aggregation)) {
+        throw new Error(`Invalid aggregation function: ${aggregation}`);
+      }
       hasAgg = true;
       attribute.push(sequelize.fn(aggregation, col));
     } else {