robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added hardening on documents link

Browse Source
This commit is contained in:
robbond
2021-11-16 19:12:03 +00:00
parent c6d4743f73
commit 831f0497c5
6 changed files with 101 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/proxy/[...route].js
+45 -74
View File
@@ -50,34 +50,23 @@ const getSASToken = () => {
};
function checkProxyPath(queryPath) {
var urlHasHash = queryPath.indexOf("&hash=");
//console.log(queryPath); //, urlHasHash, queryPath.split("&hash="));
const WORDKEY =
"028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c";
const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
const wordKey = WORDKEY;
//console.log(CryptoJS.enc.Hex.parse(wordKey));
var hashlink = CryptoJS.HmacSHA256(
queryPath,
decodeURI(queryPath),
CryptoJS.enc.Hex.parse(wordKey)
);
hashlink = hashlink.toString();
hashlink = encodeURI(hashlink);
return hashlink;
}
export default async function ApiProxy(req, res) {
//console.log(req.method);
var data = JSON.stringify(req.body);
const SASToken = getSASToken();
//console.log("the request", req.query.route, req.url);
var configNoData = {
method: req.method,
//url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")",
@@ -125,67 +114,49 @@ export default async function ApiProxy(req, res) {
responseType: "arraybuffer",
};
return new Promise((resolve, reject) => {
let hashCheckPath = req.url.split("&hash=")[0];
let hashCheckValue = req.url.split("&hash=")[1];
let hashFromRequest = checkProxyPath(hashCheckPath);
let apiPath = "";
let hashCheckPath = req.url.split("&hash=")[0];
let hashCheckValue = req.url.split("&hash=")[1];
let hashFromRequest = checkProxyPath(hashCheckPath);
// console.log(req.url);
console.log("Check:", hashCheckValue);
if (hashCheckValue == hashFromRequest) {
return new Promise((resolve, reject) => {
let hasDocument =
hashCheckPath.indexOf("/download") > 0 ? true : false;
// if (hashCheckPath > 0) {
// hashCheckValue = req.url.split("&hash=")[1];
// apiPath = req.url.split("&hash=")[0].split("/api/proxy")[1];
// } else {
// apiPath = req.url.split("/api/proxy")[1];
// }
//console.log(hashCheckPath);
console.log("Calculated:", hashFromRequest);
//console.log(req.url.split("&hash=")[0].split("/api/proxy/")[1]);
//console.log(hashCheckPath);
// console.log("from proxy :", hashCheckValue);
// // console.log(req.url);
// // console.log(apiPath);
// console.log("hashing path", hashFromRequest);
let hasDocument = apiPath.indexOf("/download") > 0 ? true : false;
// hashCheckValue == hashFromRequest
//?
axios(
req.method == "GET"
? hasDocument
? configDocument
: configNoData
: config
)
.then((response) => {
res.statusCode = 200;
if (hasDocument) {
res.setHeader(
"Content-disposition",
"attachment; filename=" +
response.headers["content-disposition"].split(
"filename="
)[1]
);
res.end(response.data);
} else {
res.setHeader("Content-Type", "application/json");
// res.setHeader("Cache-Control", "max-age=1800000");
res.end(JSON.stringify(response.data));
}
resolve();
})
.catch((error) => {
console.log("proxy response error", error);
// res.json(error);
res.status(405).end();
return resolve();
});
// : res.status(405).end();
// return resolve();
});
axios(
req.method == "GET"
? hasDocument
? configDocument
: configNoData
: config
)
.then((response) => {
res.statusCode = 200;
if (hasDocument) {
res.setHeader(
"Content-disposition",
"attachment; filename=" +
response.headers["content-disposition"].split(
"filename="
)[1]
);
res.end(response.data);
} else {
res.setHeader("Content-Type", "application/json");
// res.setHeader("Cache-Control", "max-age=1800000");
res.end(JSON.stringify(response.data));
}
resolve();
})
.catch((error) => {
console.log("proxy response error", error);
// res.json(error);
res.status(405).end();
return resolve();
});
});
} else {
res.status(405).end();
return resolve();
}
}