robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22019: phase 9 harden file handlers hash guards and negative paths

Browse Source
This commit is contained in:
robbond
2026-03-13 12:17:51 +00:00
parent 51269db849
commit c73313b0fa
7 changed files with 340 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/uploadsinglefile.js
+20 -18
View File
@@ -7,6 +7,7 @@ import {
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
import { consoleLogger } from "../../../actions/core/logger";
import { hashAPIPath } from "../../../actions/core/hash";
import { fileTypeFromBuffer } from "file-type";
import fs from "fs";
import path from "path";
@@ -36,11 +37,25 @@ ApiProxy.use(middleware);
ApiProxy.post(async (req, res) => {
var checkHash = req.query.hash;
var checkquerypath = "/api/file/uploadsinglefile";
const containerID = req.body.containerID[0];
const casefolderID = req.body.casefolderID[0];
if (hashAPIPath(checkquerypath) != "?hash=" + checkHash) {
return res.status(400).json();
}
console.log("there are files:", Object.keys(req.files).length);
const containerID = req.body?.containerID?.[0];
const casefolderID = req.body?.casefolderID?.[0];
if (
typeof containerID === "undefined" ||
containerID.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0
) {
return res.status(400).json();
}
const uploadedFiles = req.files || {};
// Add other mimetypes here
const allowedMimeTypes = [
@@ -57,7 +72,7 @@ ApiProxy.post(async (req, res) => {
var allowedFilesFormData = {};
var invalidFiles = []; // To store the names of invalid files
for (const [fileName, fileDetails] of Object.entries(req.files)) {
for (const [fileName, fileDetails] of Object.entries(uploadedFiles)) {
const file = fileDetails[0];
const filePath = file.path;
@@ -65,9 +80,6 @@ ApiProxy.post(async (req, res) => {
const fnCheck = validateFilenameServer(file.originalFilename);
if (!fnCheck.ok) {
console.log(
`File ${file.originalFilename} rejected: ${fnCheck.reason}`
);
invalidFiles.push(`${file.originalFilename} - Invalid filename`);
continue; // do not process further
}
@@ -80,7 +92,6 @@ ApiProxy.post(async (req, res) => {
try {
const type = await fileTypeFromBuffer(buffer); // Correct usage of fileTypeFromBuffer
console.log("checking mime type ", type);
if (type && allowedMimeTypes.includes(type.mime)) {
// If the MIME type from the file signature matches the allowed list
allowedFilesFormData[fileName] = fileDetails.map(
@@ -94,21 +105,12 @@ ApiProxy.post(async (req, res) => {
})
);
} else {
console.log(
`\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n\nFile ${fileName} has an invalid MIME type based on its content.\n\n\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\`
);
invalidFiles.push(fileName); // Track invalid file
}
} catch (error) {
console.log(
`Error reading file ${fileName} for MIME type validation`,
error
);
consoleLogger(error);
}
} else {
console.log(
`\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n\nFile ${fileName} has an unsupported MIME type: ${fileMimeType}\n\n\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\`
);
invalidFiles.push(fileName); // Track invalid file
}
}