Elgato_dark/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite synced 2026-05-23 00:49:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge pull request #5550 from Suven-p/feat-5542-validate-x-appwrite-id-header-for-CreateFile

Browse source 
Validate value of x-appwrite-id header
This commit is contained in:
Eldad A. Fux 2023-08-05 13:23:52 +03:00 committed by GitHub
commit a7094310d7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 34 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/config/errors.php
View file

@ -323,6 +323,11 @@ return [
'description' => 'The requested range is not satisfiable. Please check the value of the Range header.',
'code' => 416,
],
Exception::STORAGE_INVALID_APPWRITE_ID => [
'name' => Exception::STORAGE_INVALID_APPWRITE_ID,
'description' => 'The value for x-appwrite-id header is invalid. Please check the value of the x-appwrite-id header is valid id and not unique().',
'code' => 400,
],
/** Functions */
Exception::FUNCTION_NOT_FOUND => [

5
app/controllers/api/storage.php
View file

@ -450,6 +450,11 @@ App::post('/v1/storage/buckets/:bucketId/files')
throw new Exception(Exception::STORAGE_INVALID_CONTENT_RANGE);
}
$idValidator = new UID();
if (!$idValidator->isValid($request->getHeader('x-appwrite-id'))) {
throw new Exception(Exception::STORAGE_INVALID_APPWRITE_ID);
}
// TODO remove the condition that checks `$end === $fileSize` in next breaking version
if ($end === $fileSize - 1 || $end === $fileSize) {
//if it's a last chunks the chunk size might differ, so we set the $chunks and $chunk to -1 notify it's last chunk

1
src/Appwrite/Extend/Exception.php
View file

@ -107,6 +107,7 @@ class Exception extends \Exception
public const STORAGE_BUCKET_NOT_FOUND = 'storage_bucket_not_found';
public const STORAGE_INVALID_CONTENT_RANGE = 'storage_invalid_content_range';
public const STORAGE_INVALID_RANGE = 'storage_invalid_range';
public const STORAGE_INVALID_APPWRITE_ID = 'storage_invalid_appwrite_id';
/** Functions */
public const FUNCTION_NOT_FOUND = 'function_not_found';

23
tests/e2e/Services/Storage/StorageBase.php
View file

@ -240,6 +240,29 @@ trait StorageBase
$this->assertEquals(400, $failedBucket['headers']['status-code']);
/**
* Test for FAILURE set x-appwrite-id to unique()
*/
$source = realpath(__DIR__ . '/../../../resources/logo.png');
$totalSize = \filesize($source);
$res = $this->client->call(Client::METHOD_POST, '/storage/buckets/' . $bucketId . '/files', array_merge([
'content-type' => 'multipart/form-data',
'x-appwrite-project' => $this->getProject()['$id'],
'content-range' => 'bytes 0-' . $size . '/' . $size,
'x-appwrite-id' => 'unique()',
], $this->getHeaders()), [
'fileId' => ID::unique(),
'file' => new CURLFile($source, 'image/png', 'logo.png'),
'permissions' => [
Permission::read(Role::any()),
Permission::update(Role::any()),
Permission::delete(Role::any()),
],
]);
$this->assertEquals(400, $res['headers']['status-code']);
$this->assertEquals('The value for x-appwrite-id header is invalid. Please check the value of the x-appwrite-id header is valid id and not unique().', $res['body']['message']);
return ['bucketId' => $bucketId, 'fileId' => $file['body']['$id'], 'largeFileId' => $largeFile['body']['$id'], 'largeBucketId' => $bucket2['body']['$id']];
}