robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 10 harden file retrieval hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:26:06 +00:00
parent c73313b0fa
commit 368ef86b74
4 changed files with 278 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/getrepsblob.js
+15 -8
View File
@@ -47,14 +47,23 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath = "/api/file/getrepsblob?container=" + containerName;
//console.log("-----", casefolderID);
//console.log("-----", req.query);
//console.log("-----", checkquerypath);
//console.log("-----", hashAPIPath(checkquerypath));
//console.log("-----", checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getRepsBlobs(containerName, casefolderID)
@@ -72,8 +81,6 @@ ApiProxy.get(async (req, res) => {
.catch((error) => {
consoleLogger(error);
});
} else {
return res.status(400).json();
}
});