robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 10 harden file retrieval hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:26:06 +00:00
parent c73313b0fa
commit 368ef86b74
4 changed files with 278 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/getawaitingsubmissionfromblob.js
+12 -9
View File
@@ -14,16 +14,21 @@ ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/getawaitingsubmissionfromblob?container=" + containerName;
// console.log(
// "///////////////////////\ngetawaitingsubmissionblob url :",
// req.url,
// "\n///////////////////////\n"
// );
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getAllProgressBlobs(containerName)
@@ -33,8 +38,6 @@ ApiProxy.get(async (req, res) => {
.then((data) => {
return res.status(200).json(data);
});
} else {
return res.status(400).json();
}
});
pages/api/file/getprogressobjblob.js
+15 -9
View File
@@ -15,23 +15,31 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/getprogressobjblob?container=" +
containerName +
"&casefolderID=" +
casefolderID;
// console.log("-----", casefolderID);
// console.log("-----", req.query);
// console.log("-----", checkquerypath);
// console.log("-----", hashAPIPath(checkquerypath));
// console.log("-----", checkHash);
// console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getProgressBlobs(containerName, casefolderID)
.then((data) => {
//console.log("Progress blob path:", data.path);
return downloadProgressFile(
containerName,
data.path,
@@ -41,8 +49,6 @@ ApiProxy.get(async (req, res) => {
.then((data) => {
return res.status(200).json(data);
});
} else {
return res.status(400).json();
}
});
pages/api/file/getrepsblob.js
+15 -8
View File
@@ -47,14 +47,23 @@ ApiProxy.get(async (req, res) => {
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath = "/api/file/getrepsblob?container=" + containerName;
//console.log("-----", casefolderID);
//console.log("-----", req.query);
//console.log("-----", checkquerypath);
//console.log("-----", hashAPIPath(checkquerypath));
//console.log("-----", checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
const blobObj = await getRepsBlobs(containerName, casefolderID)
@@ -72,8 +81,6 @@ ApiProxy.get(async (req, res) => {
.catch((error) => {
consoleLogger(error);
});
} else {
return res.status(400).json();
}
});
tests/phase10/service-behaviour.test.cjs
+236
View File
@@ -0,0 +1,236 @@
const fs = require("fs");
const path = require("path");
const vm = require("vm");
const assert = require("assert");
const rootDir = path.resolve(__dirname, "..", "..");
const loadModule = (relativePath, injected = {}) => {
const filePath = path.join(rootDir, relativePath);
let source = fs.readFileSync(filePath, "utf8");
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
source = source.replace(
/export default async function\s+(\w+)\s*\(/,
"async function $1("
);
source = source.replace(/export const\s+/g, "const ");
source = source.replace(
/export default\s+(\w+);/g,
"module.exports.default = $1;"
);
source +=
'\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
const context = {
module: { exports: {} },
exports: {},
require,
process,
console: {
log: () => {},
info: () => {},
warn: () => {},
error: () => {}
},
...injected
};
vm.runInNewContext(source, context, { filename: filePath });
return context.module.exports;
};
const createNextConnectMock = () => {
const router = {
handler: null,
use: () => {},
get(fn) {
this.handler = fn;
}
};
return () => router;
};
const createRes = () => {
const state = {
statusCode: null,
jsonBody: undefined
};
return {
state,
setHeader: () => {},
status(code) {
state.statusCode = code;
return this;
},
json(payload) {
state.jsonBody = payload;
return payload;
}
};
};
const tests = [];
const test = (name, fn) => tests.push({ name, fn });
test("getawaitingsubmissionfromblob rejects missing hash with 400", async () => {
const calls = [];
const nextConnect = createNextConnectMock();
const mod = loadModule("pages/api/file/getawaitingsubmissionfromblob.js", {
hashAPIPath: () => "&hash=expected",
getAllProgressBlobs: async (...args) => {
calls.push(args);
return [];
},
downloadAllProgressFiles: async () => [],
_: { isEmpty: (value) => !value },
nextConnect,
middleware: () => {}
});
const req = { query: { container: "c1" } };
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("getprogressobjblob rejects missing casefolderID with 400", async () => {
const calls = [];
const nextConnect = createNextConnectMock();
const mod = loadModule("pages/api/file/getprogressobjblob.js", {
hashAPIPath: () => "&hash=expected",
getProgressBlobs: async (...args) => {
calls.push(args);
return { path: "x" };
},
downloadProgressFile: async () => ({}),
_: { isEmpty: (value) => !value },
nextConnect,
middleware: () => {}
});
const req = {
query: { container: "c1", hash: "expected" }
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("getbloblist rejects invalid hash with 400", async () => {
const calls = [];
const nextConnect = createNextConnectMock();
const mod = loadModule("pages/api/file/getbloblist.js", {
hashAPIPath: () => "&hash=expected",
getBlobs: async (...args) => {
calls.push(args);
return [];
},
getRepsFilesBlobs: async () => [],
nextConnect,
middleware: () => {}
});
const req = {
query: {
container: "c1",
casefolderID: "case-1",
hash: "wrong"
}
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("getrepsblob rejects missing hash with 400", async () => {
const calls = [];
const nextConnect = createNextConnectMock();
const mod = loadModule("pages/api/file/getrepsblob.js", {
hashAPIPath: () => "&hash=expected",
getRepsBlobs: async (...args) => {
calls.push(args);
return [];
},
downloadAllRepsFiles: async () => [],
consoleLogger: () => {},
_: { isEmpty: (value) => !value },
nextConnect,
middleware: () => {}
});
const req = {
query: {
container: "c1",
casefolderID: "case-1"
}
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(calls.length, 0);
});
test("getbloblist happy path with valid hash returns 200", async () => {
const nextConnect = createNextConnectMock();
const mod = loadModule("pages/api/file/getbloblist.js", {
hashAPIPath: () => "&hash=expected",
getBlobs: async () => ["file-1"],
getRepsFilesBlobs: async () => ["file-rep"],
nextConnect,
middleware: () => {}
});
const req = {
query: {
container: "c1",
casefolderID: "case-1",
hash: "expected"
}
};
const res = createRes();
await mod.default.handler(req, res);
assert.strictEqual(res.state.statusCode, 200);
assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
value: [["file-1"]]
});
});
const run = async () => {
let passed = 0;
for (const currentTest of tests) {
await currentTest.fn();
passed += 1;
}
console.log(
`Phase 10 behavioural tests passed (${passed}/${tests.length}).`
);
};
run().catch((error) => {
console.error(error);
process.exit(1);
});