From d0552e765e8fecda614c6ded7b3505d3cc62fbc9 Mon Sep 17 00:00:00 2001
From: Tamo <irevoire@hotmail.fr>
Date: Tue, 1 Jun 2021 20:15:51 +0200
Subject: [PATCH] forbid deserialization of Setting<Checked>

---
 meilisearch-http/src/index/update_handler.rs     | 2 +-
 meilisearch-http/src/index/updates.rs            | 5 +++--
 meilisearch-http/src/index_controller/mod.rs     | 2 +-
 meilisearch-http/src/index_controller/updates.rs | 4 ++--
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/meilisearch-http/src/index/update_handler.rs b/meilisearch-http/src/index/update_handler.rs
index 6a303b4ce..8a127168e 100644
--- a/meilisearch-http/src/index/update_handler.rs
+++ b/meilisearch-http/src/index/update_handler.rs
@@ -82,7 +82,7 @@ impl UpdateHandler {
             ),
             ClearDocuments => index.clear_documents(update_builder),
             DeleteDocuments => index.delete_documents(content, update_builder),
-            Settings(settings) => index.update_settings(settings, update_builder),
+            Settings(settings) => index.update_settings(&settings.clone().check(), update_builder),
         };
 
         match result {
diff --git a/meilisearch-http/src/index/updates.rs b/meilisearch-http/src/index/updates.rs
index 046823fb7..b4869fa42 100644
--- a/meilisearch-http/src/index/updates.rs
+++ b/meilisearch-http/src/index/updates.rs
@@ -20,14 +20,15 @@ where
     s.serialize_some(&field.as_ref().map(|o| o.as_ref().unwrap_or(&wildcard)))
 }
 
-#[derive(Clone, Default, Debug)]
+#[derive(Clone, Default, Debug, Serialize)]
 pub struct Checked;
-#[derive(Clone, Default, Debug)]
+#[derive(Clone, Default, Debug, Serialize, Deserialize)]
 pub struct Unchecked;
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 #[serde(rename_all = "camelCase")]
+#[serde(bound(serialize = "T: Serialize", deserialize = "T: Deserialize<'static>"))]
 pub struct Settings<T> {
     #[serde(
         default,
diff --git a/meilisearch-http/src/index_controller/mod.rs b/meilisearch-http/src/index_controller/mod.rs
index 0615bb731..f562d2185 100644
--- a/meilisearch-http/src/index_controller/mod.rs
+++ b/meilisearch-http/src/index_controller/mod.rs
@@ -223,7 +223,7 @@ impl IndexController {
         create: bool,
     ) -> anyhow::Result<UpdateStatus> {
         let perform_udpate = |uuid| async move {
-            let meta = UpdateMeta::Settings(settings);
+            let meta = UpdateMeta::Settings(settings.into_unchecked());
             // Nothing so send, drop the sender right away, as not to block the update actor.
             let (_, receiver) = mpsc::channel(1);
             self.update_handle.update(meta, receiver, uuid).await
diff --git a/meilisearch-http/src/index_controller/updates.rs b/meilisearch-http/src/index_controller/updates.rs
index 0aacf9b6c..303289df3 100644
--- a/meilisearch-http/src/index_controller/updates.rs
+++ b/meilisearch-http/src/index_controller/updates.rs
@@ -3,7 +3,7 @@ use milli::update::{DocumentAdditionResult, IndexDocumentsMethod, UpdateFormat};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
 
-use crate::index::{Checked, Settings};
+use crate::index::{Unchecked, Settings};
 
 pub type UpdateError = String;
 
@@ -24,7 +24,7 @@ pub enum UpdateMeta {
     },
     ClearDocuments,
     DeleteDocuments,
-    Settings(Settings<Checked>),
+    Settings(Settings<Unchecked>),
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone)]