From 36260bb405d8bc169fa7692feaba3acd3bd0e4ba Mon Sep 17 00:00:00 2001 From: robbond Date: Fri, 13 Mar 2026 12:32:37 +0000 Subject: [PATCH] TASK22019: phase 11 harden blob/delete hash guards and negative paths --- .../file/deleteawaitingsubmissionfromblob.js | 20 +- pages/api/file/deleteblob.js | 19 +- pages/api/file/getbloblist.js | 23 ++- tests/phase11/service-behaviour.test.cjs | 171 ++++++++++++++++++ 4 files changed, 219 insertions(+), 14 deletions(-) create mode 100644 tests/phase11/service-behaviour.test.cjs diff --git a/pages/api/file/deleteawaitingsubmissionfromblob.js b/pages/api/file/deleteawaitingsubmissionfromblob.js index dd459590..33dfe05b 100644 --- a/pages/api/file/deleteawaitingsubmissionfromblob.js +++ b/pages/api/file/deleteawaitingsubmissionfromblob.js @@ -13,6 +13,19 @@ ApiProxy.get(async (req, res) => { var blobName = req.query.blobname; var checkHash = req.query.hash; + if ( + typeof containerName === "undefined" || + containerName.length === 0 || + typeof casefolderID === "undefined" || + casefolderID.length === 0 || + typeof blobName === "undefined" || + blobName.length === 0 || + typeof checkHash === "undefined" || + checkHash.length === 0 + ) { + return res.status(400).json(); + } + var checkquerypath = "/api/file/deleteblob?container=" + containerName + @@ -21,8 +34,9 @@ ApiProxy.get(async (req, res) => { "&blobname=" + blobName; - //console.log(hashAPIPath(checkquerypath), checkHash); - //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash); + if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) { + return res.status(400).json(); + } if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) { await deleteBlob( @@ -31,8 +45,6 @@ ApiProxy.get(async (req, res) => { ).then((data) => { return res.status(200).json({ data: data }); }); - } else { - return res.status(400).json(); } }); diff --git a/pages/api/file/deleteblob.js b/pages/api/file/deleteblob.js index 2a57c3b6..9d99e045 100644 --- a/pages/api/file/deleteblob.js +++ b/pages/api/file/deleteblob.js @@ -13,6 +13,19 @@ ApiProxy.get(async (req, res) => { var blobName = req.query.blobname; var checkHash = req.query.hash; + if ( + typeof containerName === "undefined" || + containerName.length === 0 || + typeof casefolderID === "undefined" || + casefolderID.length === 0 || + typeof blobName === "undefined" || + blobName.length === 0 || + typeof checkHash === "undefined" || + checkHash.length === 0 + ) { + return res.status(400).json(); + } + var checkquerypath = "/api/file/deleteblob?container=" + containerName + @@ -21,6 +34,10 @@ ApiProxy.get(async (req, res) => { "&blobname=" + encodeURIComponent(blobName); + if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) { + return res.status(400).json(); + } + if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) { await deleteBlob( containerName, @@ -28,8 +45,6 @@ ApiProxy.get(async (req, res) => { ).then((data) => { return res.status(200).json({ data: data }); }); - } else { - return res.status(400).json(); } }); diff --git a/pages/api/file/getbloblist.js b/pages/api/file/getbloblist.js index 0154b8fa..a36baa52 100644 --- a/pages/api/file/getbloblist.js +++ b/pages/api/file/getbloblist.js @@ -43,18 +43,27 @@ ApiProxy.get(async (req, res) => { var casefolderID = req.query.casefolderID; var checkHash = req.query.hash; + + if ( + typeof containerName === "undefined" || + containerName.length === 0 || + typeof casefolderID === "undefined" || + casefolderID.length === 0 || + typeof checkHash === "undefined" || + checkHash.length === 0 + ) { + return res.status(400).json(); + } + var checkquerypath = "/api/file/getbloblist?container=" + containerName + "&casefolderID=" + casefolderID; - // console.log("-----", casefolderID); - // console.log("-----", req.query); - // console.log("-----", checkquerypath); - // console.log("-----", hashAPIPath(checkquerypath)); - // console.log("-----", checkHash); - // console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash); + if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) { + return res.status(400).json(); + } if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) { casefolderID.split("/").length > 1 @@ -68,8 +77,6 @@ ApiProxy.get(async (req, res) => { : await getBlobs(containerName, casefolderID).then((data) => { return res.status(200).json({ "value": [data] }); }); - } else { - return res.status(400).json(); } }); diff --git a/tests/phase11/service-behaviour.test.cjs b/tests/phase11/service-behaviour.test.cjs new file mode 100644 index 00000000..6ff5b9f7 --- /dev/null +++ b/tests/phase11/service-behaviour.test.cjs @@ -0,0 +1,171 @@ +const fs = require("fs"); +const path = require("path"); +const vm = require("vm"); +const assert = require("assert"); + +const rootDir = path.resolve(__dirname, "..", ".."); + +const loadModule = (relativePath, injected = {}) => { + const filePath = path.join(rootDir, relativePath); + let source = fs.readFileSync(filePath, "utf8"); + + source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, ""); + source = source.replace( + /export default async function\s+(\w+)\s*\(/, + "async function $1(" + ); + source = source.replace(/export const\s+/g, "const "); + source = source.replace( + /export default\s+(\w+);/g, + "module.exports.default = $1;" + ); + source += + '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n'; + + const context = { + module: { exports: {} }, + exports: {}, + require, + process, + console: { log: () => {}, error: () => {} }, + ...injected + }; + + vm.runInNewContext(source, context, { filename: filePath }); + return context.module.exports; +}; + +const createNextConnectMock = () => { + const router = { + handler: null, + use: () => {}, + get(fn) { + this.handler = fn; + } + }; + return () => router; +}; + +const createRes = () => { + const state = { statusCode: null, jsonBody: undefined }; + return { + state, + status(code) { + state.statusCode = code; + return this; + }, + json(payload) { + state.jsonBody = payload; + return payload; + } + }; +}; + +const tests = []; +const test = (name, fn) => tests.push({ name, fn }); + +test("getbloblist rejects missing hash with 400", async () => { + const calls = []; + const mod = loadModule("pages/api/file/getbloblist.js", { + hashAPIPath: () => "&hash=expected", + getBlobs: async (...args) => { + calls.push(args); + return []; + }, + getRepsFilesBlobs: async () => [], + nextConnect: createNextConnectMock(), + middleware: () => {} + }); + + const req = { query: { container: "c1", casefolderID: "case-1" } }; + const res = createRes(); + await mod.default.handler(req, res); + assert.strictEqual(res.state.statusCode, 400); + assert.strictEqual(calls.length, 0); +}); + +test("deleteblob rejects missing blobname with 400", async () => { + const calls = []; + const mod = loadModule("pages/api/file/deleteblob.js", { + hashAPIPath: () => "&hash=expected", + deleteBlob: async (...args) => { + calls.push(args); + return true; + }, + nextConnect: createNextConnectMock(), + middleware: () => {} + }); + + const req = { + query: { container: "c1", casefolderID: "case-1", hash: "expected" } + }; + const res = createRes(); + await mod.default.handler(req, res); + assert.strictEqual(res.state.statusCode, 400); + assert.strictEqual(calls.length, 0); +}); + +test("deleteawaitingsubmissionfromblob rejects invalid hash with 400", async () => { + const calls = []; + const mod = loadModule( + "pages/api/file/deleteawaitingsubmissionfromblob.js", + { + hashAPIPath: () => "&hash=expected", + deleteBlob: async (...args) => { + calls.push(args); + return true; + }, + nextConnect: createNextConnectMock(), + middleware: () => {} + } + ); + + const req = { + query: { + container: "c1", + casefolderID: "case-1", + blobname: "f.pdf", + hash: "wrong" + } + }; + const res = createRes(); + await mod.default.handler(req, res); + assert.strictEqual(res.state.statusCode, 400); + assert.strictEqual(calls.length, 0); +}); + +test("getbloblist valid hash returns 200", async () => { + const mod = loadModule("pages/api/file/getbloblist.js", { + hashAPIPath: () => "&hash=expected", + getBlobs: async () => ["f1"], + getRepsFilesBlobs: async () => ["rf1"], + nextConnect: createNextConnectMock(), + middleware: () => {} + }); + + const req = { + query: { container: "c1", casefolderID: "case-1", hash: "expected" } + }; + const res = createRes(); + await mod.default.handler(req, res); + assert.strictEqual(res.state.statusCode, 200); + assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), { + value: [["f1"]] + }); +}); + +const run = async () => { + let passed = 0; + for (const t of tests) { + await t.fn(); + passed += 1; + } + console.log( + `Phase 11 behavioural tests passed (${passed}/${tests.length}).` + ); +}; + +run().catch((error) => { + console.error(error); + process.exit(1); +});