robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 9 harden file handlers hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:17:51 +00:00
parent 51269db849
commit c73313b0fa
7 changed files with 340 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/createrepcompletemessage_api.js
+34 -17
View File
@@ -2,6 +2,8 @@ import {
getBlobs,
createRepCompleteMessage
} from "../../../actions/azurestorage";
import { hashAPIPath } from "../../../actions/core/hash";
import { consoleLogger } from "../../../actions/core/logger";
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
@@ -13,26 +15,41 @@ ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var tempCaseRef = req.query.tempcaseref;
var filename = req.query.repid;
var checkHash = req.query.hash;
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof tempCaseRef === "undefined" ||
tempCaseRef.length === 0 ||
typeof filename === "undefined" ||
filename.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
//if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await createRepCompleteMessage(containerName, tempCaseRef, filename).then(
(data) => {
console.log(
"/////Create Rep complete Message:\n" + tempCaseRef,
"\n" + "insertedOn:" + data.insertedOn,
"\n" + "messageId:" + data.messageId,
"\n" + "response.status:" + data._response.status,
"\n//////////////"
);
var checkquerypath =
"/api/file/createrepcompletemessage_api?container=" +
containerName +
"&tempcaseref=" +
tempCaseRef +
"&repid=" +
filename;
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
await createRepCompleteMessage(containerName, tempCaseRef, filename)
.then((data) => {
return res.status(200).json(data);
}
);
// } else {
// return res.status(400).json();
// }
})
.catch((error) => {
consoleLogger(error);
return res.status(400).json();
});
});
export const config = {
pages/api/file/setupcontainer.js
+10 -8
View File
@@ -17,10 +17,17 @@ ApiProxy.use(middleware);
ApiProxy.get(async (req, res) => {
var containerName = req.query.ident;
var checkHash = req.query.hash;
var checkquerypath = "/api/file/setupcontainer?ident=" + containerName;
//console.log(checkquerypath, hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof checkHash === "undefined" ||
checkHash.length === 0
) {
return res.status(400).json();
}
var checkquerypath = "/api/file/setupcontainer?ident=" + containerName;
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await createContainer(containerName)
@@ -32,11 +39,6 @@ ApiProxy.get(async (req, res) => {
res.status(400).json(error);
});
} else {
consoleLogger({
name: "setupcontainer",
code: "bad hash",
query: JSON.stringify(req.query)
});
return res.status(400).json();
}
});
pages/api/file/upload.js
+20 -28
View File
@@ -1,8 +1,9 @@
import {
createBlob,
createRepBlob,
uploadFile,
uploadFile
} from "../../../actions/azurestorage";
import { hashAPIPath } from "../../../actions/core/hash";
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
@@ -12,26 +13,26 @@ ApiProxy.use(middleware);
ApiProxy.post(async (req, res) => {
var checkHash = req.query.hash;
//console.log(JSON.stringify(req.body));
//console.log(JSON.stringify(req.body.appealData));
//console.log(req.files);
var checkquerypath = "/api/file/upload";
if (hashAPIPath(checkquerypath) != "?hash=" + checkHash) {
return res.status(400).json();
}
const appealData = req.body.appealData;
const containerID = req.body.containerID[0];
const casefolderID = req.body.casefolderID[0];
const containerID = req.body?.containerID?.[0];
const casefolderID = req.body?.casefolderID?.[0];
const repOrAppeal = req.body.repOrAppeal || false;
console.log("there are files:", Object.keys(req.files).length);
// var checkquerypath = "/api/file/upload";
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "?hash=" + checkHash);
// if (hashAPIPath(checkquerypath) == "?hash=" + checkHash) {
//createContainer(containerID).then((containerName) => {
console.log("does this get folder name:", containerID, casefolderID);
if (
typeof containerID === "undefined" ||
containerID.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0
) {
return res.status(400).json();
}
repOrAppeal
? createRepBlob(appealData, containerID, casefolderID).then((data) => {
@@ -41,7 +42,6 @@ ApiProxy.post(async (req, res) => {
// return res.status(200).json({ data });
// }
// );
console.log("================================\nRepfile updated");
return res.status(200).json({ data });
})
: createBlob(appealData, containerID, casefolderID).then((data) => {
@@ -51,22 +51,14 @@ ApiProxy.post(async (req, res) => {
// return res.status(200).json({ data });
// }
// );
console.log(
"================================\nAppeal file updated"
);
return res.status(200).json({ data });
});
//});
// } else {
// return res.status(400).json();
// }
});
export const config = {
api: {
bodyParser: false,
},
bodyParser: false
}
};
export default ApiProxy;
pages/api/file/uploadsinglefile.js
+20 -18
View File
@@ -7,6 +7,7 @@ import {
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
import { consoleLogger } from "../../../actions/core/logger";
import { hashAPIPath } from "../../../actions/core/hash";
import { fileTypeFromBuffer } from "file-type";
import fs from "fs";
import path from "path";
@@ -36,11 +37,25 @@ ApiProxy.use(middleware);
ApiProxy.post(async (req, res) => {
var checkHash = req.query.hash;
var checkquerypath = "/api/file/uploadsinglefile";
const containerID = req.body.containerID[0];
const casefolderID = req.body.casefolderID[0];
if (hashAPIPath(checkquerypath) != "?hash=" + checkHash) {
return res.status(400).json();
}
console.log("there are files:", Object.keys(req.files).length);
const containerID = req.body?.containerID?.[0];
const casefolderID = req.body?.casefolderID?.[0];
if (
typeof containerID === "undefined" ||
containerID.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0
) {
return res.status(400).json();
}
const uploadedFiles = req.files || {};
// Add other mimetypes here
const allowedMimeTypes = [
@@ -57,7 +72,7 @@ ApiProxy.post(async (req, res) => {
var allowedFilesFormData = {};
var invalidFiles = []; // To store the names of invalid files
for (const [fileName, fileDetails] of Object.entries(req.files)) {
for (const [fileName, fileDetails] of Object.entries(uploadedFiles)) {
const file = fileDetails[0];
const filePath = file.path;
@@ -65,9 +80,6 @@ ApiProxy.post(async (req, res) => {
const fnCheck = validateFilenameServer(file.originalFilename);
if (!fnCheck.ok) {
console.log(
`File ${file.originalFilename} rejected: ${fnCheck.reason}`
);
invalidFiles.push(`${file.originalFilename} - Invalid filename`);
continue; // do not process further
}
@@ -80,7 +92,6 @@ ApiProxy.post(async (req, res) => {
try {
const type = await fileTypeFromBuffer(buffer); // Correct usage of fileTypeFromBuffer
console.log("checking mime type ", type);
if (type && allowedMimeTypes.includes(type.mime)) {
// If the MIME type from the file signature matches the allowed list
allowedFilesFormData[fileName] = fileDetails.map(
@@ -94,21 +105,12 @@ ApiProxy.post(async (req, res) => {
})
);
} else {
console.log(
`\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n\nFile ${fileName} has an invalid MIME type based on its content.\n\n\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\`
);
invalidFiles.push(fileName); // Track invalid file
}
} catch (error) {
console.log(
`Error reading file ${fileName} for MIME type validation`,
error
);
consoleLogger(error);
}
} else {
console.log(
`\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n\nFile ${fileName} has an unsupported MIME type: ${fileMimeType}\n\n\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\`
);
invalidFiles.push(fileName); // Track invalid file
}
}