joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) (#8060)

Browse Source
This commit is contained in:
Manuel
2022-06-18 01:33:19 +02:00
committed by GitHub
parent ed0baa87af
commit 5be375dec2
2 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/Routers/FilesRouter.js
View File

@@ -66,6 +66,12 @@ export class FilesRouter {
getHandler(req, res) {
const config = Config.get(req.params.appId);
if (!config) {
res.status(403);
const err = new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid application ID.');
res.json({ code: err.code, error: err.message });
return;
}
const filesController = config.filesController;
const filename = req.params.filename;
const contentType = mime.getType(filename);
@@ -250,10 +256,10 @@ export class FilesRouter {
}
async metadataHandler(req, res) {
const config = Config.get(req.params.appId);
const { filesController } = config;
const { filename } = req.params;
try {
const config = Config.get(req.params.appId);
const { filesController } = config;
const { filename } = req.params;
const data = await filesController.getMetadata(filename);
res.status(200);
res.json(data);