fix(security): enforce ownership on draft blob listing proxy

pages/api/file/getbloblistproxy.js

@@ -4,13 +4,38 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
 const hasValue = (value) =>
     typeof value === "string" && value.trim().length > 0;
 
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
 export default async function ApiProxy(req, res) {
+    res.setHeader("Allow", "GET");
+
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
     const containerName = req.query.container;
     const casefolderID = req.query.casefolderID;
 
@@ -22,6 +47,23 @@ export default async function ApiProxy(req, res) {
         });
     }
 
+    if (!isValidContainer(containerName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
 
     const queryUrl =