TASK22224: harden deleteawaitingsubmission route parity

2026-03-23 17:56:14 +00:00
parent 5c29a82842
commit 6e02ffe26d
2 changed files with 124 additions and 17 deletions
@@ -9,10 +9,10 @@ const ApiProxy = nextConnect();
 ApiProxy.use(middleware);

 ApiProxy.get(async (req, res) => {
-    var containerName = req.query.container;
-    var casefolderID = req.query.casefolderID;
-    var blobName = req.query.blobname;
-    var checkHash = req.query.hash;
+    const containerName = req.query.container;
+    const casefolderID = req.query.casefolderID;
+    const blobName = req.query.blobname;
+    const checkHash = req.query.hash;

    if (
        typeof containerName === "undefined" ||
@@ -31,15 +31,43 @@ ApiProxy.get(async (req, res) => {
        });
    }

-    var checkquerypath =
-        "/api/file/deleteblob?container=" +
-        containerName +
-        "&casefolderID=" +
-        casefolderID +
-        "&blobname=" +
-        blobName;
+    const casefolderIDTrimmed = casefolderID.trim();
+    const blobNameTrimmed = blobName.trim();

-    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+    const hashCandidatePaths = [
+        "/api/file/deleteawaitingsubmissionfromblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderIDTrimmed +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/deleteawaitingsubmissionfromblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderIDTrimmed) +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed),
+
+        // legacy compatibility with callers that hash against deleteblob route
+        "/api/file/deleteblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderIDTrimmed +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/deleteblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderIDTrimmed) +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed)
+    ];
+
+    const isHashValid = hashCandidatePaths.some(
+        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
+    );
+
+    if (!isHashValid) {
        return respondError(res, {
            status: 400,
            code: "INVALID_HASH",
@@ -47,11 +75,22 @@ ApiProxy.get(async (req, res) => {
        });
    }

-    await deleteBlob(containerName, casefolderID + "/files/" + blobName).then(
-        (data) => {
-            return respondSuccess(res, { data: data });
-        }
-    );
+    try {
+        const normalizedBlobName = blobNameTrimmed.startsWith(
+            casefolderIDTrimmed + "/"
+        )
+            ? blobNameTrimmed
+            : casefolderIDTrimmed + "/files/" + blobNameTrimmed;
+
+        const data = await deleteBlob(containerName, normalizedBlobName);
+        return respondSuccess(res, { data: data });
+    } catch (error) {
+        return respondError(res, {
+            status: 400,
+            code: "DELETE_AWAITING_SUBMISSION_BLOB_FAILED",
+            message: "Unable to delete awaiting submission blob"
+        });
+    }
 });

 export const config = {