Fix invalid votes from the API being accepted (#12601)

* Fix invalid votes from the API being accepted

Fixes #12556

- Ensure `choice` is an integer instead of silently converting to 0
- Ensure `choice` corresponds to an actual choice of the poll

* Please CodeClimate

1 files changed, 8 insertions, 0 deletions

diff --git a/app/validators/vote_validator.rb b/app/validators/vote_validator.rb
index 2e1818bdb..b1692562d 100644
--- a/app/validators/vote_validator.rb
+++ b/app/validators/vote_validator.rb
@@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator
   def validate(vote)
     vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired?
 
+    vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote)
+
     if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists?
       vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
     elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists?
       vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
     end
   end
+
+  private
+
+  def invalid_choice?(vote)
+    vote.choice.negative? || vote.choice >= vote.poll.options.size
+  end
 end