fix(security): enforce ownership on draft blob listing proxy
This commit is contained in:
@@ -2189,59 +2189,219 @@ test("admin representation completion accepts legitimate filename punctuation",
|
||||
assert.strictEqual(loaded.calls.queue.length, 1);
|
||||
});
|
||||
|
||||
test("getbloblistproxy success returns proxied payload", async () => {
|
||||
const loadBlobListProxy = ({ session, ...overrides } = {}) => {
|
||||
const calls = {
|
||||
session: [],
|
||||
options: [],
|
||||
token: 0,
|
||||
hash: [],
|
||||
headers: [],
|
||||
axios: []
|
||||
};
|
||||
const options = { id: "pedw-blob-list-options" };
|
||||
const payload = { value: [{ id: "blob-1" }] };
|
||||
const resolvedSession =
|
||||
typeof session === "undefined"
|
||||
? { user: { id: "user-container" } }
|
||||
: session;
|
||||
const mod = loadModule("pages/api/file/getbloblistproxy.js", {
|
||||
respondError: respondErrorMock,
|
||||
respondSuccess: respondSuccessMock,
|
||||
getToken: async () => ({ access_token: "tok" }),
|
||||
azureHeaders: () => ({ headers: { Authorization: "Bearer tok" } }),
|
||||
hashAPIPath: () => "&hash=abc",
|
||||
authOptions: (req, res) => {
|
||||
calls.options.push([req, res]);
|
||||
return options;
|
||||
},
|
||||
getServerSession: async (...args) => {
|
||||
calls.session.push(args);
|
||||
return resolvedSession;
|
||||
},
|
||||
getToken: async () => {
|
||||
calls.token += 1;
|
||||
return { access_token: "synthetic-token" };
|
||||
},
|
||||
azureHeaders: (accessToken) => {
|
||||
calls.headers.push(accessToken);
|
||||
return {
|
||||
headers: { Authorization: "Bearer synthetic-token" }
|
||||
};
|
||||
},
|
||||
hashAPIPath: (queryPath) => {
|
||||
calls.hash.push(queryPath);
|
||||
return "&hash=synthetic-hash";
|
||||
},
|
||||
consoleLogger: () => {},
|
||||
process: { env: { API_ROOT: "http://example.com" } },
|
||||
axios: {
|
||||
get: async () => ({ data: { value: [{ id: "b1" }] } })
|
||||
}
|
||||
get: async (...args) => {
|
||||
calls.axios.push(args);
|
||||
return { data: payload };
|
||||
}
|
||||
},
|
||||
...overrides
|
||||
});
|
||||
|
||||
const req = {
|
||||
query: { container: "cont/1", casefolderID: "CASE/1" }
|
||||
};
|
||||
return { mod, calls, options, payload };
|
||||
};
|
||||
|
||||
const blobListProxyRequest = (overrides = {}) => ({
|
||||
method: "GET",
|
||||
query: { container: "user-container", casefolderID: "CASE/1" },
|
||||
headers: {},
|
||||
...overrides
|
||||
});
|
||||
|
||||
const assertNoBlobListProxyWork = (calls) => {
|
||||
assert.strictEqual(calls.token, 0);
|
||||
assert.strictEqual(calls.hash.length, 0);
|
||||
assert.strictEqual(calls.headers.length, 0);
|
||||
assert.strictEqual(calls.axios.length, 0);
|
||||
};
|
||||
|
||||
test("getbloblistproxy rejects unsupported methods before authentication or proxy work", async () => {
|
||||
const loaded = loadBlobListProxy();
|
||||
const res = createRes();
|
||||
await mod.default(req, res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 200);
|
||||
assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
|
||||
value: [{ id: "b1" }]
|
||||
await loaded.mod.default(blobListProxyRequest({ method: "POST" }), res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 405);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
|
||||
assert.strictEqual(loaded.calls.options.length, 0);
|
||||
assert.strictEqual(loaded.calls.session.length, 0);
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
|
||||
test("getbloblistproxy rejects a missing container before authentication or proxy work", async () => {
|
||||
const loaded = loadBlobListProxy();
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(
|
||||
blobListProxyRequest({ query: { casefolderID: "CASE/1" } }),
|
||||
res
|
||||
);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
|
||||
assert.strictEqual(loaded.calls.options.length, 0);
|
||||
assert.strictEqual(loaded.calls.session.length, 0);
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
|
||||
test("getbloblistproxy rejects a malformed container before authentication or proxy work", async () => {
|
||||
const loaded = loadBlobListProxy();
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(
|
||||
blobListProxyRequest({
|
||||
query: { container: "Invalid_Container", casefolderID: "CASE/1" }
|
||||
}),
|
||||
res
|
||||
);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
|
||||
assert.strictEqual(loaded.calls.options.length, 0);
|
||||
assert.strictEqual(loaded.calls.session.length, 0);
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
|
||||
test("getbloblistproxy rejects a missing casefolderID before authentication or proxy work", async () => {
|
||||
const loaded = loadBlobListProxy();
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(
|
||||
blobListProxyRequest({ query: { container: "user-container" } }),
|
||||
res
|
||||
);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
|
||||
assert.strictEqual(loaded.calls.options.length, 0);
|
||||
assert.strictEqual(loaded.calls.session.length, 0);
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
|
||||
for (const sessionCase of [
|
||||
{ name: "missing session", session: null },
|
||||
{ name: "session without user id", session: { user: {} } },
|
||||
{ name: "session with empty user id", session: { user: { id: "" } } },
|
||||
{ name: "session with non-string user id", session: { user: { id: 123 } } }
|
||||
]) {
|
||||
test(`getbloblistproxy rejects ${sessionCase.name} before proxy work`, async () => {
|
||||
const loaded = loadBlobListProxy({ session: sessionCase.session });
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(blobListProxyRequest(), res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 403);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
}
|
||||
|
||||
test("getbloblistproxy rejects cross-container access before proxy work", async () => {
|
||||
const loaded = loadBlobListProxy({
|
||||
session: { user: { id: "different-container" } }
|
||||
});
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(blobListProxyRequest(), res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 403);
|
||||
assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
|
||||
assertNoBlobListProxyWork(loaded.calls);
|
||||
});
|
||||
|
||||
test("getbloblistproxy preserves signed path, bearer header and response for owning user", async () => {
|
||||
const loaded = loadBlobListProxy();
|
||||
const req = blobListProxyRequest();
|
||||
const res = createRes();
|
||||
|
||||
await loaded.mod.default(req, res);
|
||||
|
||||
const expectedPath =
|
||||
"/api/file/getbloblist?container=user-container&casefolderID=CASE%2F1";
|
||||
assert.strictEqual(res.state.statusCode, 200);
|
||||
assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
|
||||
assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
|
||||
assert.strictEqual(loaded.calls.token, 1);
|
||||
assert.deepStrictEqual(loaded.calls.hash, [expectedPath]);
|
||||
assert.deepStrictEqual(loaded.calls.headers, ["synthetic-token"]);
|
||||
assert.strictEqual(loaded.calls.axios.length, 1);
|
||||
assert.strictEqual(
|
||||
loaded.calls.axios[0][0],
|
||||
`http://example.com${expectedPath}&hash=synthetic-hash`
|
||||
);
|
||||
assert.deepStrictEqual(loaded.calls.axios[0][1], {
|
||||
headers: { Authorization: "Bearer synthetic-token" }
|
||||
});
|
||||
assert.deepStrictEqual(
|
||||
JSON.parse(JSON.stringify(res.state.jsonBody)),
|
||||
loaded.payload
|
||||
);
|
||||
});
|
||||
|
||||
test("getbloblistproxy dependency failure returns GET_BLOB_LIST_PROXY_FAILED", async () => {
|
||||
const mod = loadModule("pages/api/file/getbloblistproxy.js", {
|
||||
respondError: respondErrorMock,
|
||||
respondSuccess: respondSuccessMock,
|
||||
getToken: async () => ({ access_token: "tok" }),
|
||||
azureHeaders: () => ({ headers: {} }),
|
||||
hashAPIPath: () => "&hash=abc",
|
||||
consoleLogger: () => {},
|
||||
process: { env: { API_ROOT: "http://example.com" } },
|
||||
const loaded = loadBlobListProxy({
|
||||
axios: {
|
||||
get: async () => {
|
||||
get: async (...args) => {
|
||||
loaded.calls.axios.push(args);
|
||||
throw new Error("proxy failed");
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
const req = {
|
||||
query: { container: "c1", casefolderID: "f1" }
|
||||
};
|
||||
const res = createRes();
|
||||
await mod.default(req, res);
|
||||
await loaded.mod.default(blobListProxyRequest(), res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(
|
||||
res.state.jsonBody.error.code,
|
||||
"GET_BLOB_LIST_PROXY_FAILED"
|
||||
);
|
||||
assert.strictEqual(loaded.calls.token, 1);
|
||||
assert.strictEqual(loaded.calls.hash.length, 1);
|
||||
assert.strictEqual(loaded.calls.headers.length, 1);
|
||||
assert.strictEqual(loaded.calls.axios.length, 1);
|
||||
});
|
||||
|
||||
const loadOrdinaryRepsProxy = (overrides = {}) => {
|
||||
|
||||
Reference in New Issue
Block a user