TASK22057: phase17 closeout hash/input consistency hardening

pages/api/file/generateappealpdf.js

@@ -114,13 +114,32 @@ export default async function handler(req, res) {
     var checkHash = req.query.hash;
     var appealType = req.query.appealType;
 
-    let appealBodyObj = req.body; //JSON.parse(req.body);
+    let appealBodyObj =
+        typeof req.body === "string" ? JSON.parse(req.body) : req.body;
     var containerID = appealBodyObj.containerID;
     var casefolderID = appealBodyObj.casefolderID;
     var caseRef = appealBodyObj.caseRef;
-    var filesList = appealBodyObj.filesList;
     var checkquerypath = "/api/file/generateappealpdf";
 
+    if (
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0 ||
+        typeof appealType === "undefined" ||
+        String(appealType).length === 0 ||
+        typeof containerID === "undefined" ||
+        String(containerID).length === 0 ||
+        typeof casefolderID === "undefined" ||
+        String(casefolderID).length === 0
+    ) {
+        return res.status(400).json();
+    }
+
+    checkquerypath = checkquerypath + "?appealType=" + appealType;
+
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
     // Create Document Component
     const MyDocument = (values) => {
         switch (values.docProps.pinswg_appealcasetype) {
@@ -200,11 +219,6 @@ export default async function handler(req, res) {
         containerID,
         blobProgress.pinswg_name || blobProgress.caseObj.ticketnumber
     ).then((data) => {
-        console.log(
-            "///////////////////////////////////\nfile created: " +
-                `/files/${pdfFileName}.pdf`,
-            "\n/////////////////////////"
-        );
         return res.status(200).json({
             status: "success",
             data: data,