TASK22057: phase17 closeout hash/input consistency hardening

pages/api/file/createappealcompletemessageproxy_api.js

@@ -2,10 +2,6 @@ import { hashAPIPath } from "../../../actions/core/hash";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
-import {
-    getBlobs,
-    createCaseCompleteMessage
-} from "../../../actions/azurestorage";
 import axios from "axios";
 
 import nextConnect from "next-connect";
@@ -14,32 +10,32 @@ import middleware from "../middleware/middleware";
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
+
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
 ApiProxy.get(async (req, res) => {
     var containerName = req.query.container;
     var tempCaseRef = req.query.tempcaseref;
 
-    console.log("/////Create Case Message:\n", tempCaseRef, "\n//////////////");
-
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (!hasValue(containerName) || !hasValue(tempCaseRef)) {
+        return res.status(400).json();
+    }
 
     var token = await getToken();
 
     var queryUrl =
-        "/api/file/createappealcompletemessageproxy_api?container=" +
-        containerID +
+        "/api/file/createappealcompletemessage_api?container=" +
+        containerName +
         "&tempcaseref=" +
-        caseReference;
+        tempCaseRef;
 
-    var config = {
-        method: "get",
-        url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl)
-    };
-
-    return axios(config)
-        .then((res) => {
-            return res.data;
-        })
+    return axios
+        .get(
+            BASE_URL + queryUrl + hashAPIPath(queryUrl),
+            azureHeaders(token.access_token)
+        )
         .then(({ data }) => {
             res.status(200).json(data);
         })

pages/api/file/generateappealpdf.js

@@ -114,13 +114,32 @@ export default async function handler(req, res) {
     var checkHash = req.query.hash;
     var appealType = req.query.appealType;
 
-    let appealBodyObj = req.body; //JSON.parse(req.body);
+    let appealBodyObj =
+        typeof req.body === "string" ? JSON.parse(req.body) : req.body;
     var containerID = appealBodyObj.containerID;
     var casefolderID = appealBodyObj.casefolderID;
     var caseRef = appealBodyObj.caseRef;
-    var filesList = appealBodyObj.filesList;
     var checkquerypath = "/api/file/generateappealpdf";
 
+    if (
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0 ||
+        typeof appealType === "undefined" ||
+        String(appealType).length === 0 ||
+        typeof containerID === "undefined" ||
+        String(containerID).length === 0 ||
+        typeof casefolderID === "undefined" ||
+        String(casefolderID).length === 0
+    ) {
+        return res.status(400).json();
+    }
+
+    checkquerypath = checkquerypath + "?appealType=" + appealType;
+
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
     // Create Document Component
     const MyDocument = (values) => {
         switch (values.docProps.pinswg_appealcasetype) {
@@ -200,11 +219,6 @@ export default async function handler(req, res) {
         containerID,
         blobProgress.pinswg_name || blobProgress.caseObj.ticketnumber
     ).then((data) => {
-        console.log(
-            "///////////////////////////////////\nfile created: " +
-                `/files/${pdfFileName}.pdf`,
-            "\n/////////////////////////"
-        );
         return res.status(200).json({
             status: "success",
             data: data,

pages/api/file/generatepdf.js

@@ -178,13 +178,27 @@ export default async function handler(req, res) {
 
     var checkquerypath = "/api/file/generatepdf";
 
+    if (shouldDownload) {
+        checkquerypath += "?download=true";
+    }
+
+    if (typeof checkHash === "undefined" || checkHash.length === 0) {
+        return res.status(400).json();
+    }
+
+    if (
+        hashAPIPath(checkquerypath) !=
+        (checkquerypath.indexOf("?") > -1 ? "&hash=" : "?hash=") + checkHash
+    ) {
+        return res.status(400).json();
+    }
+
     //console.log("-------", checkHash);
     //console.log(hashAPIPath(checkquerypath) == "?hash=" + checkHash);
     //console.log(casefolderID, caseRef);
     // Create Document Component
 
     const MyDocument = (values) => {
-        console.log(values.docProps.locale);
         switch (values.docProps.representationType) {
             case "Questionnaire":
                 switch (values.docProps.appealType) {
@@ -325,11 +339,6 @@ export default async function handler(req, res) {
         reqBodyobj.repfile_name
     )
         .then((data) => {
-            console.log(
-                "///////////////////////////////////\nrep pdf file created: " +
-                    `${caseRef}/files/${reqBodyobj.repfile_name}.pdf`,
-                "\n/////////////////////////"
-            );
             if (shouldDownload) {
                 const filename = `${reqBodyobj.repfile_name || "questionnaire"}.pdf`;
                 res.setHeader("Content-Type", "application/pdf");