TASK22017: phase 8 hardening for sensitive hash-guarded APIs

pages/api/file/deleteblobrep.js

@@ -1,5 +1,5 @@
 import { hashAPIPath } from "../../../actions/core/hash";
-import { deleteBlobCase, deleteBlobRep } from "../../../actions/azurestorage";
+import { deleteBlobRep } from "../../../actions/azurestorage";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -11,9 +11,19 @@ ApiProxy.get(async (req, res) => {
     var containerName = req.query.container;
     var casefolderID = req.query.casefolderID;
     var repfile = req.query.repfile;
-    var blobName = req.query.blobname;
     var checkHash = req.query.hash;
 
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0 ||
+        typeof repfile === "undefined" ||
+        repfile.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var checkquerypath =
         "/api/file/deleteblobrep?container=" +
         containerName +
@@ -24,16 +34,13 @@ ApiProxy.get(async (req, res) => {
 
     casefolderID = casefolderID + "/" + repfile;
 
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
-
-    //if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-    await deleteBlobRep(containerName, casefolderID).then((data) => {
-        return res.status(200).json({ data: data });
-    });
-    // } else {
-    //     return res.status(400).json();
-    // }
+    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
+        await deleteBlobRep(containerName, casefolderID).then((data) => {
+            return res.status(200).json({ data: data });
+        });
+    } else {
+        return res.status(400).json();
+    }
 });
 
 export const config = {