找出这个生成的资料处理器在授权、输入处理和密钥暴露方面的缺陷。
JavaScript
async function updateProfile(request, store, audit) {
const profile = await store.find(request.body.userId);
if (!profile) {
return { status: 404, body: { error: "not found" } };
}
if (request.body.displayName.length > 80) {
return { status: 400, body: { error: "too long" } };
}
profile.displayName = request.body.displayName.trim();
audit.push({
authorization: request.headers.authorization,
profile,
});
await store.save(profile);
return { status: 200, body: profile };
}