fix(core): Remove insecure fallback from default price selection strat

Relates to #GHSA-wm63-7627-ch33
vendure-ecommerce · Nov 15, 2023 · 6f34d06 · 6f34d06
1 parent 3538bee
commit 6f34d06
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 4 deletions.
diff --git a/packages/core/src/config/catalog/default-product-variant-price-selection-strategy.ts b/packages/core/src/config/catalog/default-product-variant-price-selection-strategy.ts
@@ -18,6 +18,6 @@ export class DefaultProductVariantPriceSelectionStrategy implements ProductVaria
     selectPrice(ctx: RequestContext, prices: ProductVariantPrice[]) {
         const pricesInChannel = prices.filter(p => idsAreEqual(p.channelId, ctx.channelId));
         const priceInCurrency = pricesInChannel.find(p => p.currencyCode === ctx.currencyCode);
-        return priceInCurrency || pricesInChannel[0];
+        return priceInCurrency;
     }
 }
diff --git a/packages/core/src/plugin/default-search-plugin/indexer/mutable-request-context.ts b/packages/core/src/plugin/default-search-plugin/indexer/mutable-request-context.ts
@@ -1,3 +1,4 @@
+import { CurrencyCode } from '@vendure/common/lib/generated-types';
 import { ID } from '@vendure/common/lib/shared-types';
 
 import { RequestContext, SerializedRequestContext } from '../../../api/common/request-context';
@@ -28,6 +29,10 @@ export class MutableRequestContext extends RequestContext {
         return this.mutatedChannel?.id ?? super.channelId;
     }
 
+    get currencyCode(): CurrencyCode {
+        return this.mutatedChannel?.defaultCurrencyCode ?? super.currencyCode;
+    }
+
     static deserialize(ctxObject: SerializedRequestContext): MutableRequestContext {
         return new MutableRequestContext({
             req: ctxObject._req,

diff --git a/packages/core/src/service/services/product-variant.service.ts b/packages/core/src/service/services/product-variant.service.ts
@@ -443,17 +443,18 @@ export class ProductVariantService {
             );
         }
 
-        const defaultChannelId = (await this.channelService.getDefaultChannel(ctx)).id;
+        const defaultChannel = await this.channelService.getDefaultChannel(ctx);
         await this.createOrUpdateProductVariantPrice(ctx, createdVariant.id, input.price, ctx.channelId);
-        if (!idsAreEqual(ctx.channelId, defaultChannelId)) {
+        if (!idsAreEqual(ctx.channelId, defaultChannel.id)) {
             // When creating a ProductVariant _not_ in the default Channel, we still need to
             // create a ProductVariantPrice for it in the default Channel, otherwise errors will
             // result when trying to query it there.
             await this.createOrUpdateProductVariantPrice(
                 ctx,
                 createdVariant.id,
                 input.price,
-                defaultChannelId,
+                defaultChannel.id,
+                defaultChannel.defaultCurrencyCode,
             );
         }
         return createdVariant.id;