TASK22019: phase 12 harden download and blob proxy guards

2026-03-13 12:49:54 +00:00
parent 36260bb405
commit 0ca63d0228
5 changed files with 206 additions and 2 deletions
@@ -16,6 +16,19 @@ ApiProxy.get(async (req, res) => {
    var blobName = req.query.blobname;
    var checkHash = req.query.hash;

+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0 ||
+        typeof blobName === "undefined" ||
+        blobName.length === 0 ||
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
    var checkquerypath =
        "/api/file/downloadblob?container=" +
        containerName +
@@ -24,6 +37,10 @@ ApiProxy.get(async (req, res) => {
        "&blobname=" +
        blobName.trim();

+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
        const bloblocation =
            casefolderID + (blobName.indexOf(".json") > 0 ? "/" : "/files/");
@@ -38,8 +55,6 @@ ApiProxy.get(async (req, res) => {
            "attachment; filename=" + decodeURI(blobName)
        );
        return res.status(200).send(downloaded);
-    } else {
-        return res.status(400).json();
    }
 });