TASK22019: phase 9 harden file handlers hash guards and negative paths

pages/api/file/createrepcompletemessage_api.js

@@ -2,6 +2,8 @@ import {
     getBlobs,
     createRepCompleteMessage
 } from "../../../actions/azurestorage";
+import { hashAPIPath } from "../../../actions/core/hash";
+import { consoleLogger } from "../../../actions/core/logger";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -13,26 +15,41 @@ ApiProxy.get(async (req, res) => {
     var containerName = req.query.container;
     var tempCaseRef = req.query.tempcaseref;
     var filename = req.query.repid;
+    var checkHash = req.query.hash;
 
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof tempCaseRef === "undefined" ||
+        tempCaseRef.length === 0 ||
+        typeof filename === "undefined" ||
+        filename.length === 0 ||
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0
+    ) {
+        return res.status(400).json();
+    }
 
-    //if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-    await createRepCompleteMessage(containerName, tempCaseRef, filename).then(
-        (data) => {
-            console.log(
-                "/////Create Rep complete Message:\n" + tempCaseRef,
-                "\n" + "insertedOn:" + data.insertedOn,
-                "\n" + "messageId:" + data.messageId,
-                "\n" + "response.status:" + data._response.status,
-                "\n//////////////"
-            );
+    var checkquerypath =
+        "/api/file/createrepcompletemessage_api?container=" +
+        containerName +
+        "&tempcaseref=" +
+        tempCaseRef +
+        "&repid=" +
+        filename;
+
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
+    await createRepCompleteMessage(containerName, tempCaseRef, filename)
+        .then((data) => {
             return res.status(200).json(data);
-        }
-    );
-    // } else {
-    //     return res.status(400).json();
-    // }
+        })
+        .catch((error) => {
+            consoleLogger(error);
+            return res.status(400).json();
+        });
 });
 
 export const config = {