TASK22019: phase 9 harden file handlers hash guards and negative paths

pages/api/file/upload.js

@@ -1,8 +1,9 @@
 import {
     createBlob,
     createRepBlob,
-    uploadFile,
+    uploadFile
 } from "../../../actions/azurestorage";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -12,26 +13,26 @@ ApiProxy.use(middleware);
 
 ApiProxy.post(async (req, res) => {
     var checkHash = req.query.hash;
-    //console.log(JSON.stringify(req.body));
-    //console.log(JSON.stringify(req.body.appealData));
-    //console.log(req.files);
+
+    var checkquerypath = "/api/file/upload";
+
+    if (hashAPIPath(checkquerypath) != "?hash=" + checkHash) {
+        return res.status(400).json();
+    }
 
     const appealData = req.body.appealData;
-    const containerID = req.body.containerID[0];
-    const casefolderID = req.body.casefolderID[0];
+    const containerID = req.body?.containerID?.[0];
+    const casefolderID = req.body?.casefolderID?.[0];
     const repOrAppeal = req.body.repOrAppeal || false;
 
-    console.log("there are files:", Object.keys(req.files).length);
-
-    // var checkquerypath = "/api/file/upload";
-
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "?hash=" + checkHash);
-
-    // if (hashAPIPath(checkquerypath) == "?hash=" + checkHash) {
-    //createContainer(containerID).then((containerName) => {
-
-    console.log("does this get folder name:", containerID, casefolderID);
+    if (
+        typeof containerID === "undefined" ||
+        containerID.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0
+    ) {
+        return res.status(400).json();
+    }
 
     repOrAppeal
         ? createRepBlob(appealData, containerID, casefolderID).then((data) => {
@@ -41,7 +42,6 @@ ApiProxy.post(async (req, res) => {
               //               return res.status(200).json({ data });
               //           }
               //       );
-              console.log("================================\nRepfile updated");
               return res.status(200).json({ data });
           })
         : createBlob(appealData, containerID, casefolderID).then((data) => {
@@ -51,22 +51,14 @@ ApiProxy.post(async (req, res) => {
               //               return res.status(200).json({ data });
               //           }
               //       );
-              console.log(
-                  "================================\nAppeal file updated"
-              );
               return res.status(200).json({ data });
           });
-    //});
-
-    // } else {
-    //     return res.status(400).json();
-    // }
 });
 
 export const config = {
     api: {
-        bodyParser: false,
-    },
+        bodyParser: false
+    }
 };
 
 export default ApiProxy;