robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 11 harden blob/delete hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:32:37 +00:00
parent 368ef86b74
commit 36260bb405
4 changed files with 219 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/deleteawaitingsubmissionfromblob.js
+16 -4
View File
@@ -13,6 +13,19 @@ ApiProxy.get(async (req, res) => {
var blobName = req.query.blobname;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof blobName === "undefined" ||
blobName.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/deleteblob?container=" +
containerName +
@@ -21,8 +34,9 @@ ApiProxy.get(async (req, res) => {
"&blobname=" +
blobName;
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlob(
@@ -31,8 +45,6 @@ ApiProxy.get(async (req, res) => {
).then((data) => {
return res.status(200).json({ data: data });
});
} else {
return res.status(400).json();
}
});
pages/api/file/deleteblob.js
+17 -2
View File
@@ -13,6 +13,19 @@ ApiProxy.get(async (req, res) => {
var blobName = req.query.blobname;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof blobName === "undefined" ||
blobName.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/deleteblob?container=" +
containerName +
@@ -21,6 +34,10 @@ ApiProxy.get(async (req, res) => {
"&blobname=" +
encodeURIComponent(blobName);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlob(
containerName,
@@ -28,8 +45,6 @@ ApiProxy.get(async (req, res) => {
).then((data) => {
return res.status(200).json({ data: data });
});
} else {
return res.status(400).json();
}
});
pages/api/file/getbloblist.js
+15 -8
View File
@@ -43,18 +43,27 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/getbloblist?container=" +
containerName +
"&casefolderID=" +
casefolderID;
// console.log("-----", casefolderID);
// console.log("-----", req.query);
// console.log("-----", checkquerypath);
// console.log("-----", hashAPIPath(checkquerypath));
// console.log("-----", checkHash);
// console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
casefolderID.split("/").length > 1
@@ -68,8 +77,6 @@ ApiProxy.get(async (req, res) => {
: await getBlobs(containerName, casefolderID).then((data) => {
return res.status(200).json({ "value": [data] });
});
} else {
return res.status(400).json();
}
});
tests/phase11/service-behaviour.test.cjs
+171
View File
@@ -0,0 +1,171 @@
const fs = require("fs");
const path = require("path");
const vm = require("vm");
const assert = require("assert");
const rootDir = path.resolve(__dirname, "..", "..");
const loadModule = (relativePath, injected = {}) => {
const filePath = path.join(rootDir, relativePath);
let source = fs.readFileSync(filePath, "utf8");
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
source = source.replace(
/export default async function\s+(\w+)\s*\(/,
"async function $1("
);
source = source.replace(/export const\s+/g, "const ");
source = source.replace(
/export default\s+(\w+);/g,
"module.exports.default = $1;"
);
source +=
'\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
const context = {
module: { exports: {} },
exports: {},
require,
process,
console: { log: () => {}, error: () => {} },
...injected
};
vm.runInNewContext(source, context, { filename: filePath });
return context.module.exports;
};
const createNextConnectMock = () => {
const router = {
handler: null,
use: () => {},
get(fn) {
this.handler = fn;
}
};
return () => router;
};
const createRes = () => {
const state = { statusCode: null, jsonBody: undefined };
return {
state,
status(code) {
state.statusCode = code;
return this;
},
json(payload) {
state.jsonBody = payload;
return payload;
}
};
};
const tests = [];
const test = (name, fn) => tests.push({ name, fn });
test("getbloblist rejects missing hash with 400", async () => {
const calls = [];
const mod = loadModule("pages/api/file/getbloblist.js", {
hashAPIPath: () => "&hash=expected",
getBlobs: async (...args) => {
calls.push(args);
return [];
},
getRepsFilesBlobs: async () => [],
nextConnect: createNextConnectMock(),
middleware: () => {}
});
const req = { query: { container: "c1", casefolderID: "case-1" } };
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("deleteblob rejects missing blobname with 400", async () => {
const calls = [];
const mod = loadModule("pages/api/file/deleteblob.js", {
hashAPIPath: () => "&hash=expected",
deleteBlob: async (...args) => {
calls.push(args);
return true;
},
nextConnect: createNextConnectMock(),
middleware: () => {}
});
const req = {
query: { container: "c1", casefolderID: "case-1", hash: "expected" }
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("deleteawaitingsubmissionfromblob rejects invalid hash with 400", async () => {
const calls = [];
const mod = loadModule(
"pages/api/file/deleteawaitingsubmissionfromblob.js",
{
hashAPIPath: () => "&hash=expected",
deleteBlob: async (...args) => {
calls.push(args);
return true;
},
nextConnect: createNextConnectMock(),
middleware: () => {}
}
);
const req = {
query: {
container: "c1",
casefolderID: "case-1",
blobname: "f.pdf",
hash: "wrong"
}
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("getbloblist valid hash returns 200", async () => {
const mod = loadModule("pages/api/file/getbloblist.js", {
hashAPIPath: () => "&hash=expected",
getBlobs: async () => ["f1"],
getRepsFilesBlobs: async () => ["rf1"],
nextConnect: createNextConnectMock(),
middleware: () => {}
});
const req = {
query: { container: "c1", casefolderID: "case-1", hash: "expected" }
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 200);
assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
value: [["f1"]]
});
});
const run = async () => {
let passed = 0;
for (const t of tests) {
await t.fn();
passed += 1;
}
console.log(
`Phase 11 behavioural tests passed (${passed}/${tests.length}).`
);
};
run().catch((error) => {
console.error(error);
process.exit(1);
});