CODEWITHSUNDEEP
firebasefirebase-security
Justin Noel
Justin Noel

Reputation: 6205

Firebase Validation

I'm just starting with Firebase and doing some simple testing. I'm having trouble with validation.

Here is some sample code:

var Firebase = require("firebase");

var myFirebaseRef = new Firebase("https://familytrial.firebaseio.com/");

myFirebaseRef.child("families").on("value", function(snapshot) {
  console.log("Something changed!");
  console.log("%j", snapshot.val());
  console.log("\n\n\n");

}, function(err) {
  console.log("Something failed!");
  console.log(err);
});

setTimeout( function() {

  myFirebaseRef.child('families').push({
    "familyName" : "Jones",
    "members" : {
      "givenName" : "Jim",
      "calledName" : "Koolaid",
      "parent" : true
    }
  }, function(err) {
    if(err) {
      console.log("\nAn error occurred");
      console.log(err);
    }
  })
}, 3000);


setTimeout( function() {

  myFirebaseRef.child('families').push({
    "familyName" : "The Jones Have a Ridiculously Long Family Name That Should Get Rejected",
    "members" : {
      "givenName" : "Jim",
      "calledName" : "Koolaid",
      "parent" : true
    }
  }, function(err) {
    if(err) {
      console.log("\nAn error occurred");
      console.log(err);
    }
  })
}, 3000);

This code works just fine when the validations are:

{
  "rules": {
    ".read" : true,
    ".write" : true
  }
}

However, when I try to validate anything in families, I get permission errors or the validation simply doesn't seem to restrict input.

{
  "rules": {
    ".write": true,
    ".read": true,
    "families": {
      "familyName": {
        ".validate": "newData.isString() && newData.val().length < 50"
      }
    }
  }
}

I would expect that validation rule to allow the first push to 'families' and reject the second. However, it accepts both pushes.

What am I doing wrong with that validation?

Thanks, Justin

Upvotes: 1

Views: 1326

Answers (1)

Justin Noel
Justin Noel

Reputation: 6205

@Kato alluded to the answer. Here's the complete explanation.

I was trying to create a member of the families object. Like this:

{"familyName":"Jones","members":{"givenName":"Jim","calledName":"Koolaid","parent":true}}

So, that would create a structure like : 

{
  "families": {
    "some_object_id": {
      "familyName": "Jones",
      "members": {
        "givenName": "Jim",
        "calledName": "Koolaid",
        "parent": true
      }
    }
  }
}

However, my validation rules were for validating a familyname property on the families object. That validation rule would have worked great for something like this:

{
  "families": {
    "familyName": "Jones"    
  }
}

This is not what I wanted. My correct validation, needed to be like this:

{
  "rules": {
    ".read": false,
    ".write": false,
    "families": {
      ".read": true,
      "$families_id": {
        ".write": "!data.exists() && newData.exists()",
        "familyName": {
          ".validate": "newData.isString() && newData.val().length > 1 && newData.val().length < 50"
        }
      }
    }
  }
}

Upvotes: 3

Related Questions