Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid non-blob webresources fields on multipart requests #746

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+34 −8
Open

Avoid non-blob webresources fields on multipart requests #746

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 24 additions & 8 deletions src/webresource-handler/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ export const getWebresourceHandler = (): WebResourceHandler | undefined => {
const isFileInValidPath = async (
fieldname: string,
req: Express.Request,
odataRequest: uriParser.ParsedODataRequest,
): Promise<boolean> => {
if (req.method !== 'POST' && req.method !== 'PATCH') {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we allow multipart requests on requests that aren't POST/PATCH?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Page- We don't do anything, basically. Whatever is the content of multpart/body in those requests is just dropped. IMHO it is the expected behaviour as it is the same thing of a GET request with a body (it works, but the body is just ignored as it should not be there).

return false;
Expand All @@ -77,10 +78,6 @@ const isFileInValidPath = async (
return false;
}
const model = getModel(apiRoot);
const odataRequest = uriParser.parseOData({
url: req.url,
method: req.method,
});
const sqlResourceName = sbvrUtils.resolveSynonym(odataRequest);

const table = model.abstractSql.tables[sqlResourceName];
Expand Down Expand Up @@ -124,6 +121,15 @@ export const getUploaderMiddlware = (
const bb = busboy({ headers: req.headers });
let isAborting = false;

const parsedOdataRequest = uriParser.parseOData({
otaviojacobi marked this conversation as resolved.
Show resolved Hide resolved
url: req.url,
method: req.method,
});
const webResourcesFieldNames = getWebResourceFields(
parsedOdataRequest,
false,
);

const finishFileUpload = () => {
req.unpipe(bb);
req.on('readable', req.read.bind(req));
Expand Down Expand Up @@ -151,7 +157,9 @@ export const getUploaderMiddlware = (
completeUploads.push(
(async () => {
try {
if (!(await isFileInValidPath(fieldname, req))) {
if (
!(await isFileInValidPath(fieldname, req, parsedOdataRequest))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a later improvement there's a lot of work done in isFileInValidPath that would be nice to avoid duplicating if there are multiple uploads in a single request. I don't know if the duplication is avoidable but I suspect so

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added in my todo list for webresources

) {
filestream.resume();
return;
}
Expand Down Expand Up @@ -183,6 +191,14 @@ export const getUploaderMiddlware = (
// This receives the form fields and transforms them into a standard JSON body
// This is a similar behavior as previous multer library did
bb.on('field', (name, val) => {
if (webResourcesFieldNames.includes(name)) {
isAborting = true;
bb.emit(
'error',
new errors.BadRequestError('WebResource field must be a blob.'),
);
return;
}
req.body[name] = val;
});

Expand All @@ -207,17 +223,17 @@ export const getUploaderMiddlware = (
}
});

bb.on('error', async (err) => {
bb.on('error', async (err: Error) => {
await clearFiles();
finishFileUpload();
next(err);
sbvrUtils.handleHttpErrors(req, res, err);
});
req.pipe(bb);
};
};

const getWebResourceFields = (
request: uriParser.ODataRequest,
request: uriParser.ODataRequest | uriParser.ParsedODataRequest,
useTranslations = true,
): string[] => {
// Translations will use modifyFields(translated) rather than fields(original) so we need to
Expand Down
10 changes: 10 additions & 0 deletions test/06-webresource.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -484,6 +484,16 @@ describe('06 webresources tests', function () {
expect(await isEventuallyDeleted(uniqueFilename)).to.be.true;
});

it('should not accept webresource payload that is not a blob', async () => {
const res = await supertest(testLocalServer)
.post(`/${resourceName}/organization`)
.field('name', 'John')
.field(resourcePath, 'not a blob')
.expect(400);

expect(res.body).to.equal('WebResource field must be a blob.');
});

it('should not accept webresource payload on application/json requests', async () => {
const uniqueFilename = `${randomUUID()}_${filename}`;

Expand Down
Loading