From 9038bdcd1d29eea7907e2e0d84863a0c793db704 Mon Sep 17 00:00:00 2001
From: NEOLPAR <ricardo@neolpar.com>
Date: Fri, 9 Sep 2022 11:13:18 +0100
Subject: [PATCH] added plugin validation

---
 packages/server/src/api/controllers/plugin.ts |  6 +++++-
 packages/string-templates/yarn.lock           | 16 ----------------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/packages/server/src/api/controllers/plugin.ts b/packages/server/src/api/controllers/plugin.ts
index cb4d592812..3941798ac4 100644
--- a/packages/server/src/api/controllers/plugin.ts
+++ b/packages/server/src/api/controllers/plugin.ts
@@ -7,6 +7,7 @@ import {
   uploadedFilePlugin,
 } from "./plugin/utils"
 import { getGlobalDB } from "@budibase/backend-core/tenancy"
+import { validate } from "@budibase/backend-core/plugins"
 import { generatePluginID, getPluginParams } from "../../db/utils"
 import {
   uploadDirectory,
@@ -80,13 +81,16 @@ export async function create(ctx: any) {
         directory = directoryGithub
         break
       case "url":
+        const headersObj = JSON.parse(headers || null) || {}
         const { metadata: metadataUrl, directory: directoryUrl } =
-          await uploadedUrlPlugin(url, name, headers)
+          await uploadedUrlPlugin(url, name, headersObj)
         metadata = metadataUrl
         directory = directoryUrl
         break
     }
 
+    validate(metadata?.schema)
+
     const doc = await storePlugin(metadata, directory, source)
 
     ctx.body = {
diff --git a/packages/string-templates/yarn.lock b/packages/string-templates/yarn.lock
index dc7e8f1852..8e71e59912 100644
--- a/packages/string-templates/yarn.lock
+++ b/packages/string-templates/yarn.lock
@@ -568,15 +568,6 @@
     magic-string "^0.25.7"
     resolve "^1.17.0"
 
-"@rollup/plugin-inject@^4.0.0":
-  version "4.0.4"
-  resolved "https://registry.yarnpkg.com/@rollup/plugin-inject/-/plugin-inject-4.0.4.tgz#fbeee66e9a700782c4f65c8b0edbafe58678fbc2"
-  integrity sha512-4pbcU4J/nS+zuHk+c+OL3WtmEQhqxlZ9uqfjQMQDOHOPld7PsCd8k5LWs8h5wjwJN7MgnAn768F2sDxEP4eNFQ==
-  dependencies:
-    "@rollup/pluginutils" "^3.1.0"
-    estree-walker "^2.0.1"
-    magic-string "^0.25.7"
-
 "@rollup/plugin-json@^4.1.0":
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/@rollup/plugin-json/-/plugin-json-4.1.0.tgz#54e09867ae6963c593844d8bd7a9c718294496f3"
@@ -3796,13 +3787,6 @@ rollup-plugin-node-resolve@^5.2.0:
     resolve "^1.11.1"
     rollup-pluginutils "^2.8.1"
 
-rollup-plugin-polyfill-node@^0.10.2:
-  version "0.10.2"
-  resolved "https://registry.yarnpkg.com/rollup-plugin-polyfill-node/-/rollup-plugin-polyfill-node-0.10.2.tgz#b2128646851fcb9475ddfd5bc22ca1a8c568738d"
-  integrity sha512-5GMywXiLiuQP6ZzED/LO/Q0HyDi2W6b8VN+Zd3oB0opIjyRs494Me2ZMaqKWDNbGiW4jvvzl6L2n4zRgxS9cSQ==
-  dependencies:
-    "@rollup/plugin-inject" "^4.0.0"
-
 rollup-plugin-terser@^7.0.2:
   version "7.0.2"
   resolved "https://registry.yarnpkg.com/rollup-plugin-terser/-/rollup-plugin-terser-7.0.2.tgz#e8fbba4869981b2dc35ae7e8a502d5c6c04d324d"