TASK22019: phase 10 harden file retrieval hash guards and negative paths

pages/api/file/getprogressobjblob.js

@@ -15,23 +15,31 @@ ApiProxy.get(async (req, res) => {
     var casefolderID = req.query.casefolderID;
 
     var checkHash = req.query.hash;
+
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0 ||
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var checkquerypath =
         "/api/file/getprogressobjblob?container=" +
         containerName +
         "&casefolderID=" +
         casefolderID;
 
-    // console.log("-----", casefolderID);
-    // console.log("-----", req.query);
-    // console.log("-----", checkquerypath);
-    // console.log("-----", hashAPIPath(checkquerypath));
-    // console.log("-----", checkHash);
-    // console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
 
     if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
         const blobObj = await getProgressBlobs(containerName, casefolderID)
             .then((data) => {
-                //console.log("Progress blob path:", data.path);
                 return downloadProgressFile(
                     containerName,
                     data.path,
@@ -41,8 +49,6 @@ ApiProxy.get(async (req, res) => {
             .then((data) => {
                 return res.status(200).json(data);
             });
-    } else {
-        return res.status(400).json();
     }
 });