TASK22019: phase 10 harden file retrieval hash guards and negative paths

2026-03-13 12:26:06 +00:00
parent c73313b0fa
commit 368ef86b74
4 changed files with 278 additions and 26 deletions
@@ -14,16 +14,21 @@ ApiProxy.get(async (req, res) => {
    var containerName = req.query.container;
    var checkHash = req.query.hash;

+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
    var checkquerypath =
        "/api/file/getawaitingsubmissionfromblob?container=" + containerName;

-    // console.log(
-    //     "///////////////////////\ngetawaitingsubmissionblob url :",
-    //     req.url,
-    //     "\n///////////////////////\n"
-    // );
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }

    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
        const blobObj = await getAllProgressBlobs(containerName)
@@ -33,8 +38,6 @@ ApiProxy.get(async (req, res) => {
            .then((data) => {
                return res.status(200).json(data);
            });
-    } else {
-        return res.status(400).json();
    }
 });