TASK22019: phase 12 harden download and blob proxy guards

pages/api/file/downloadblob.js

@@ -16,6 +16,19 @@ ApiProxy.get(async (req, res) => {
     var blobName = req.query.blobname;
     var checkHash = req.query.hash;
 
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0 ||
+        typeof blobName === "undefined" ||
+        blobName.length === 0 ||
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var checkquerypath =
         "/api/file/downloadblob?container=" +
         containerName +
@@ -24,6 +37,10 @@ ApiProxy.get(async (req, res) => {
         "&blobname=" +
         blobName.trim();
 
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
     if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
         const bloblocation =
             casefolderID + (blobName.indexOf(".json") > 0 ? "/" : "/files/");
@@ -38,8 +55,6 @@ ApiProxy.get(async (req, res) => {
             "attachment; filename=" + decodeURI(blobName)
         );
         return res.status(200).send(downloaded);
-    } else {
-        return res.status(400).json();
     }
 });
 

pages/api/file/getawaitingsubmissionfromblobproxy.js

@@ -23,6 +23,11 @@ const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
     var checkHash = req.query.hash;
+
+    if (typeof containerName === "undefined" || containerName.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var queryUrl =

pages/api/file/getbloblistproxy.js

@@ -24,6 +24,16 @@ export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
     var casefolderID = req.query.casefolderID;
     var checkHash = req.query.hash;
+
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var queryUrl =

pages/api/file/getrepsblobproxy.js

@@ -23,6 +23,11 @@ const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
     var checkHash = req.query.hash;
+
+    if (typeof containerName === "undefined" || containerName.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var queryUrl = "/api/file/getrepsblob?container=" + containerName;