robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 10 harden file retrieval hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:26:06 +00:00
parent c73313b0fa
commit 368ef86b74
4 changed files with 278 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/getawaitingsubmissionfromblob.js
+12 -9
View File
@@ -14,16 +14,21 @@ ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/getawaitingsubmissionfromblob?container=" + containerName;
// console.log(
// "///////////////////////\ngetawaitingsubmissionblob url :",
// req.url,
// "\n///////////////////////\n"
// );
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getAllProgressBlobs(containerName)
@@ -33,8 +38,6 @@ ApiProxy.get(async (req, res) => {
.then((data) => {
return res.status(200).json(data);
});
} else {
return res.status(400).json();
}
});
pages/api/file/getprogressobjblob.js
+15 -9
View File
@@ -15,23 +15,31 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/getprogressobjblob?container=" +
containerName +
"&casefolderID=" +
casefolderID;
// console.log("-----", casefolderID);
// console.log("-----", req.query);
// console.log("-----", checkquerypath);
// console.log("-----", hashAPIPath(checkquerypath));
// console.log("-----", checkHash);
// console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getProgressBlobs(containerName, casefolderID)
.then((data) => {
//console.log("Progress blob path:", data.path);
return downloadProgressFile(
containerName,
data.path,
@@ -41,8 +49,6 @@ ApiProxy.get(async (req, res) => {
.then((data) => {
return res.status(200).json(data);
});
} else {
return res.status(400).json();
}
});
pages/api/file/getrepsblob.js
+15 -8
View File
@@ -47,14 +47,23 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath = "/api/file/getrepsblob?container=" + containerName;
//console.log("-----", casefolderID);
//console.log("-----", req.query);
//console.log("-----", checkquerypath);
//console.log("-----", hashAPIPath(checkquerypath));
//console.log("-----", checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getRepsBlobs(containerName, casefolderID)
@@ -72,8 +81,6 @@ ApiProxy.get(async (req, res) => {
.catch((error) => {
consoleLogger(error);
});
} else {
return res.status(400).json();
}
});